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SECTION 1 


SUMMARY 


The objective of this program was to develop an advanced concept for the 
Detection, Isolation, and Accommodation (DIA) of sensor failures in gas 
turbine engine control systems. Participants in the program were the Commer- 
cial Products Division and Government Products Division of Pratt & Whitney 
Aircraft Group, and Systems Control, Inc. (Vt.), with sponsorship provided by 
NASA Lewis Research Center. 

Five advanced concepts were formulated from advanced techniques for detection, 
isolation, and accommodation of sensor failures. The concepts were evaluated 
by application in an FIDO engine and Multivariable Control System simulation. 
The FIDO Multivariable Control System was developed under Air Force Contract 
AFWAL-TR-80-2010. A simplified version of the simulation of the FIDO engine 
and multivariable control system was used in a screening process to select one 
of these advanced concepts. This simplified simulation was also used as the 
model for the filters in the various advanced detection, isolation and accom- 
modation concepts. 

The selected advanced concept utilizes a Weighted Sum- Squared Residuals tech- 
nique to detect soft failures. A normal mode Kalman filter; i.e., a filter 
designed to use all sensor inputs with no failure assumed on those inputs, is 
used to generate the residuals and the estimated measurements. Detection and 
isolation of hard-over failures is also accomplished with the normal mode fil- 
ter by testing for large values of the individual residuals. Isolation of soft 
failures is accomplished by likelihood ratio based testing of innovations from 
a bank of Kalman filters, each designed with the assumption of one failed 
input. Accommodation is accomplished by reconfiguring the normal mode Kalman 
filter to eliminate the failed sensor from the input. 

A baseline detection, isolation and accommodation concept was also developed 
based upon the conventional techniques of parameter synthesis. Performance of 
this concept and the selected advanced concept was evaluated in detail on the 
complete nonlinear dynamic simulation of the engine and control system. 

Results of the detailed evaluation demonstrated that the advanced concept is a 
viable method for a sensor failure detection system. While performance was 
generally comparable to that of the parameter synthesis based concept, the 
advanced concept represents a more systematic design approach. Given a reason- 
ably accurate plant model and sensor failure characteristics, the design of 
the various Kalman filters and detection and isolation tests is relatively 
straightforward. The parameter synthesis based concept requires significant 
trial and error analysis and refinement to develop useful gas generator rela- 
tionships and associated logic for detecting, isolating, and accommodating 
sensor failures. The evaluation results did show that the simplified model 
used for the advanced concept was not accurate enough at a number of flight 
operating points. This was found to result from insufficient linearized data 
at these flight conditions to constrain the curve fits used in the implementa- 
tion of the model. Additional refinement of the simplified model is expected 
to provide significant performance improvements of the advanced concept. 



SECTION 2 


INTRODUCTION 

An orderly transition from hydomechanical control systems to full authority 
digital electronic control systems is currently in progress throughout the 
aircraft propulsion industry. Full authority means that all control logic 
functions are provided in the digital computer. The full authority digital 
electronic control system will provide increases in turbine life, elimination 
of ground trim requirements, improved engine performance, and reduced pilot 
workload as a result of the capability to implement accurate control of engine 
thrust and temperature ratings. 

Other hardware and software features will include a modular construction 
approach, automatic trouble-shooting and self test devices, and fault toler- 
ance logic. These features will simplify maintenance procedures and thereby 
reduce maintenance costs for the control system relative to current hydromech- 
anical control systems. Paradoxically, present design philosophy emphasizes 
hardware redundancy to attain acceptable levels of mission reliability. This 
program addressed software, or analytical redundancy on measured parameters to 
provide acceptable mission reliability with minimal sensor hardware redundancy. 

The logic programming capability of a full authority digital electronic con- 
trol allows the incorporation of fault logic to accomplish three basic func- 
tions: 1) computer self-test; 2) actuator interface failure identification; 
and 3) sensor failure detection, isolation and accommodation (DIA). Fault 
tolerance logic can provide essentially fail operational control capability 
with a minimum number of parts and therefore contributes to a reduction in 
control related Mean Time Between In-Flight Shutdowns. For military aircraft, 
this means improved weapon system availability and mission effectiveness. 

Over the past decade of electronic control system development, extensive work 
has been accomplished in the areas of developing comprehensive techniques for 
computer self-test and actuator interface failure identification. Relatively 
simplistic techniques have been applied to the sensor failure DIA problem. 

Several techniques are available for the application to the sensor failure DIA 
task. For hard-over failures of sensors, simple range-check logic provides the 
simplest detection procedure, but redundant sensors, measurement synthesis, or 
control mode modification are required to accommodate the failed sensor. Soft 
failures, such as sensor drift, and sensor noise require more sophisticated 
logic or redundancy of sensors. With triple sensors, voting logic can be im- 
plemented to determine sensors with soft failures; however, these redundant 
sensors significantly increase control system cost, weight, complexity, and 
failure rate. 

Therefore, to minimize the impact of hardware redundancy requires the develop- 
ment of a software detection, isolation and accommodation concept which can 
provide "analytical redundancy" equivalent to having multiple hardware sen- 
sors. The conventional approach for accomplishing this is to synthesize values 
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of measurements from other available parameters in the control system by using 
gas generator functional relationships, such as shown in Figure 1. Such syn- 
thesized measurements can be compared with single sensor measurements, or with 
dual measurements in a voting scheme, to evaluate the health of the sensors. A 
tolerance band must be established between synthesized and measured values to 
avoid false alarms due to: 

0 Uncertainty in synthesis curves 

0 Actuator failure impacts 

0 Sensor tolerances 

0 Engine-to-engine tolerances 

0 Horsepower and bleed extraction variations in-service 

0 Engine deterioration 

0 Transient versus steady state conditions 

The effort to develop the parameter synthesis technique and to minimize the 
required tolerance band to accommodate these effects can be substantial. 

More sophisticated concepts such as the Kalman filter, whose typical implemen- 
tation is shown in Figure 2, have also been suggested for the gas turbine sen- 
sor failure problem. Such techniques may offer a more systematic approach to 
the design of an effective sensor detection, isolation and accommodation con- 
cept and can automatically accommodate, in theory, many of the above varia- 
tions which require a tolerance band for the parameter synthesis technique. 
However, basic research in this area has re.sulted in a proliferation of such 
advanced techniques. It is not obvious which of these techniques can be suc- 
cessfully applied to the gas turbine engine sensor problem and result in a 
sensor failure detection, isolation and acconmodation concept which performs 
better than the conventional parameter synthesis approach. 

To evaluate the applicability of the advanced detection, isolation and accom- 
modation concepts to gas turbine engines, NASA Lewis Research Center sponsored 
the program which is the subject of this report. To accomplish the program 
goals, a team was established, consisting of Pratt & Whitney Aircraft Commer- 
cial and Government Products Division and Systems Control Inc. (Vt), (SCI) of 
California, with Pratt & Whitney Aircraft Commercial Products Division (CPD) 
being the prime contractor. Figure 3 shows the team members' primary responsi- 
bilities for this program. This program utilized the FIDO engine and FIDO 
Multivariable Control (MVC) logic (described in Section 3.1), developed under 
Air Force contract, as the test bed system for concept evaluation. 

A summary of the complete program is presented in the following paragraphs: 

The types of sensors to be used for the engine parameters required in the FIDO 
Multivariable Control System were selected. Typical state-of-the-art transdu- 
cers were selected to ensure a realistic definition of the sensor failure 
modes and characteristics. Sensor failure characteristics for the selected 
sensor types were defined and quantified according to the predominant failure 
categories of out-of-ronge, drift, and noise. This task is described in detail 
in Section 3.2. 
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P3 HIGH COMPRESSOR EXIT PRESSURE 

T22 HIGH COMPRESSOR INLET TEMPERATURE 

T3 HIGH COMPRESSOR EXIT TEMPERATURE 

S22 T22/518 7 


Figure 1 Examples of Synthesis of a Parameter from Gas Generator Character- 
istics - Compressor discharge temperature may be synthesized from a 
functional relationship between corrected rotor speed, pressure 
ratio, and compressor inlet temperature. 


DIGITAL ELECTRONIC CONTROL 



Figure 2 Typical Implementation of a Kalman Filter - Sophisticated logic may 
be implemented in the electronic control to estimate sensor outputs 
contaminated by noise or to synthesize a parameter when its sensor 
fail s. 
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Figure 3 Team Members and Primary Responsibilities 


A Failure Mode and Effects Criticality Analysis (FMECA) was conducted using 
the FIDO Multivariable Control System simulation. Each sensor failure was 
evaluated at 15 flight operating points. This provided the necessary informa- 
tion to classify the various failure modes into categories of critical and 
non-critical failures. Critical failures are defined as any failure which 
results in a fan or compressor surge, excessive thrust variation (greater than 
10%) or a rotor overspeed above the operating limits. A detailed description 
and the results of this study are included in Section 3.3. 
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A Detection, Isolation and Accommodation (DIA) concept scoring system was 
developed which quantitatively and qualitatively evaluates the candidate con- 
cept for: 

1. DIA Criteria 

2. DIA Detection Performance 

3. DIA Figures of Merit 

The DIA criteria are defined as the set of transient and steady state opera- 
tional requirements which the propulsion system must satisfy in the event of 
various potential sensor failures in order to meet minimum aircraft operation- 
al requirements. DIA Detection Performance relates to how effective the con- 
cept is in terms of detecting and isolating a sensor failure. In other words, 
if the DIA concept has excellent accommodation capability, but cannot consis- 
tently detect failures, then it is not a good concept. The DIA figures of 
merit are more qualitative in nature, and are defined as the benefits of 
bettering DIA criteria in the event of single failures or meeting criteria in 
the event of multiple sensor failures. The details of the evaluation approach 
and the evaluation results are described in Section 3.4. 

Available techniques for detection, isolation, and accommodation were reviewed 
to determine which techniques or combination of techniques yield detection, 
isolation and accommodation concepts having a theoretical basis applicable to 
the turbine engine sensor failure problem. From this review, a set of five 
candidate concepts was selected. These concepts were formulated to span as 
many of the applicable techniques as possible. The advanced detection, 
isolation and accommodation techniques which were reviewed are discussed in 
Section 4.3. 

A simplified FIDO engine simulation was constructed for use in screening the 
five concepts in order to minimize computer run times. The simplified simula- 
tion consists of a fourth order state variable model augmented with nonlinear 
steady state relationships to result in an accurate representation of nonlin- 
ear engine characteristics. The details of the development of the simplified 
nonlinear model are discussed in Section 4.2. The five candidate concepts were 
implemented in the simplified simulation and evaluated relative to performance 
for single sensor failures. Using the detection, isolation and accommodation 
scoring system, each candidate concept was quantitatively evaluated on its 
ability to detect, isolate and accommodate the single sensor failures as well 
as on their ability to satisfy the criteria as previously described. Two 
concepts were selected from this initial screening process. A more detailed 
analysis was conducted on these two concepts. This evaluation led to the 
selection of one concept for implementation and evaluation on the detailed 
nonlinear FIDO engine. Results of the concept evaluation process are presented 
in Section 4.4. 

In addition to investigating advanced detection, isolation and accommodation 
concepts, an algorithm, based upon conventional Parameter Synthesis techni- 
ques, was developed as a baseline system for evaluating the performance of the 
selected advanced concept. The parameter synthesis based algorithm is descri- 
bed in Section 4.1 
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A detailed evaluation of the parameter synthesis based algorithm and advanced 
concept detection, isolation and accommodation algorithm was conducted by 
simulating sensor failures for both steady state and transient operation at 
the 15 flight operating points, using the nonlinear FI 00 Multivariable Control 
System simulation. The evaluation results of the two algorithms were compared 
to determine the benefits of implementing advanced algorithms in production 
control systems, rather than the conventional parameter synthesis techniques 
currently used. The results of this comparison are presented in Section 5. 



SECTION 3.0 


PROBLEM DEFINITION 

The initial portion of this program was concerned with defining and character- 
izing the subject engine control system sensor failures and developing a 
scoring system for evaluating advanced detection, isolation and accommodation 
concepts. This effort as shown in Figure 4 involved a review of the FI 00 
Multivariable Control (MVC) System requirements, defining the sensor types to 
be used and determining the various failure modes of those sensors. A Failure 
Mode and Effects Criticality Analysis (FMECA) was performed to determine the 
impact of a sensor failure on engine operation and thereby establish which 
sensors are critical. Detection, isolation and accommodation criteria, figures 
of merit, and an overall evaluation methodology were established to provide a 
quantitative basis for concept selection. 

The following paragraphs present a detailed description of this portion of the 
program. 

3.1 FIDO ENGINE AND MULTIVARIABLE CONTROL MODE DESCRIPTION 

The engine selected as a testbed system for evaluating sensor failure Detec- 
tion, Isolation, and Accommodation (DIA) concepts is a Pratt & Whitney 
Aircraft FIDO afterburning turbofan, representative of current high technology 
engines. The FIDO is low bypass ratio, twin-spool, axial-flow turbofan engine, 
consisting of the following components: 

0 Three-stage fan driven by a two stage turbine 

o Ten-stage compressor driven by an aircooled two-stage turbine 

o Main burner with an annular chamber 

0 Annular fan duct that surrounds the basic gas generator and dis- 
charges air in the mixed flow augmentor. 

0 Variable area nozzle 

An inlet guide vane with a movable trailing edge to achieve variable airfoil 
camber is used ahead of the fan to improve inlet distortion tolerance and fan 
efficiency. The first three stators of the high compressor are variable to 
improve starting and high Mach number characteristics. Airflow bleed is ex- 
tracted at the compressor exit for installation requirements and starting. The 
exhaust nozzle for the engine is a balance beam design with actuated divergent 
flap. The variable geometry of the balanced-beam nozzle enables all three 
nozzle performance parameters (nozzle area, expansion ratio, and boattail 
drag) to be simultaneously near optimum throughout the operating range. 
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Figure 4 Task I Failure Definition Procedure 

The engine simulation includes a simulation of the multivariable control mode. 
This control mode was developed by Systems Control, Inc. and Pratt & Whitney 
Aircraft under the FIDO Multivariable Control Synthesis Program (Air Force 
Contract No. AFWAL-TR-80-2010) which was funded as a cooperative effort be- 
tween the Air Force Aero Propulsion Laboratory and NASA Lewis Research Center. 

A simplified block diagram of the FIDO multivariable control system is shown 
in Figure 5. The control mode is basically proportional plus integral with a 
feed-forward path to provide rapid response. The proportional control action 
is provided by the Linear Quadratic Regulator, (LQR) with the regulator gains 
Cp able to affect changes in all of the available control variables U to 
reduce deviations in all of the state variables X relative to the specified 
reference point X^q^. The state, control, and output variables used in the 
multivariable control are as follows: 
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state Variables 


Control Variables 


Output Variables 


Fan Speed 
Compressor Speed 
Afterburner Pressure 
Fuel Flow 
Burner Pressure 


Fuel Flow Thrust 

Nozzle Area Fan Airflow 

Compressor Inlet Variable Vanes Burner Temperature 
Rear Compressor Variable Vanes Fan Surge Margin 
Bleed Flow Compressor Surge Margin 



I I L 1 i_ J 


Figure 5 Simplified Block Diagram of FlOO Multivariable Control System 

The feedback law itself represents an optimal regulator structure with inte- 
gral trims for steady-state accuracy and a model following implementation to 
prevent saturation during transients. Each element of the control law is 
described briefly below. 

The control law is written for small perturbations of state and control vari- 
ables about an equilibrium condition. The equilibrium conditions must be deri- 
ved approximately by the controller given the requested power level, altitude, 
Mach number, engine face pressure and temperature. A functional (or tabular) 
description of these equilibrium conditions is a reference point schedule. 

The reference schedules are produced by calculating the thermodynamic equili- 
brium associated with a given control vector at a representative group of sub- 
sonic and supersonic flight points. Nondimensionalized quantities were then 
utilized to fit approximate reference points with minimum complexity. 
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When a large transition in power is requested by the pilot, the small pertur- 
bation character assumed in the regulator design is lost. A large change in 
the reference state vector will cause large commanded inputs. This tends to 
saturate actuators and produce significantly nonlinear behavior unless a feed 
forward control input is provided. The transition control generates this sig- 
nal. A regulator can then be used to track the compatible trajectory taking 
the system from one state to another. 

The dynamic response of the engine is affected strongly by the air mass flow. 
Power level, altitude and Mach number determine this mass flow and the re- 
sponse. The linearized control synthesis procedure produces regulator gains 
that control the engine satisfactorily in the neighborhood of the design 
flight/power point. To implement a continuous envelope-wide controller, the 
gains are varied as the system makes the transition from one condition to 
another. 

The gain scheduling adopted for the FlOO implementation approximately fits 
important gain elements with univariate functions of the engine face density 
and rotor speed. The former variable accounts for altitude effects, while the 
latter schedules the power condition. Dominant gain elements were determined 
by assessing the closed-loop ergenvalue sensitivity of the system to each gain 
element and eliminating those that do not affect closed-loop response. 

The engine set-point is a group of reference values of states and controls 
which the engine must attain exactly in steady-state. These values define the 
equilibrium point. Error terms are calculated between these reference values 
and corresponding sensed values. These error terms always are integrated 
unless the associated control variables are driven transiently into satura- 
tion. To avoid integrator wind-up due to this uncontrollable situation, the 
appropriate error is switched out until the transient command tends to cause 
the control to unsaturate. This switching logic provides smooth and controlled 
engine transition for changes in power and flight condition. 

The engine protection logic provides hard limits on the commands to the con- 
trol actuators. The engine protection logic includes fuel flow, variable vane, 
bleed air and exhaust nozzle area limits. Whenever a commanded actuator posi- 
tion exceeds a specified limit or when a control saturation is detected, a 
flag is set with the control logic. These flags send a signal within the logic 
to clamp and hold the appropriate trim integrator to prevent integrator 
wind-up. 

Temperature limiting during transient and steady-state operation is a critical 
function of any turbine engine control system. For the FlOO, the maximum tem- 
peratures specified for compressor discharge and turbine inlet stations in the 
gas path are implicitly limited by the maximum fan turbine inlet temperature 
(FTIT). The fan turbine inlet temperature sensor output response is extremely 
slow relative to the temperature overshoot criteria, however. Compensation of 
this signal was, therefore, required to provide adequate temperature limiting 
during transient maneuvers. For the FlOO Multivariable Control System program, 
this was implemented with a steady-state, third-order filter to estimate fan 
turbine inlet temperature. For the Sensor Failure Detection System program, 
this filter was eliminated since fan turbine inlet temperature was one of the 
variables used in the advanced detection, isolation, and accommodation algo- 
ri thm. 
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3.2 SELECTED SENSOR SET AND FAILURE CLASSIFICATIONS 


3.2.1 Selection of Sensor Set 

A list of the required engine sensors and sensor types was compiled for FI 00 
Multivariable Control (MVC) application. Typical state-of-the-art sensors were 
selected for the engine parameters to ensure the best chance of defining 
realistic sensor failure modes and characteristics. Sensor selection was also 
directed toward satisfying hardware requirements such as availability, cost, 
reliability, durability and system compatability. A list of the sensed vari- 
ables and associated sensor types is shown in Table I. 

The advanced Detection, Isolation and Accommodation algorithms and the para- 
meter synthesis based algorithm developed for this program were designed to 
detect, isolate and accommodate failures of the PT6, PT4, N1 , N2, and fan 
turbine inlet temperature sensors. These parameters were selected since they 
are basic feedback parameters in the Multivariable Control Mode. 

3.2.2 Sensor Failure Classification 

Sensor failure rates and failure modes were defined for the selected sensor 
set. The failure rates for each type of sensor and its associated electrical 
harness were obtained from historical U. S. Air Force records for the FIDO 
military engine and from failure mode and effects analysis conducted by Pratt 
& Whitney Aircraft and component vendors in support of other electronic 
control development programs. 


TABLE I 

ENGINE PARAMETER SENSOR LIST 
Multivariable Control for the FIDO Engine 


Sensed Variable 

Engine Face Temperature 

Engine Face Pressure 

Fan Discharge Temperature 

Fan Speed 

Compressor Speed 

Burner Pressure 

Fan Turbine Inlet Temperature 

Augmentor Total Pressure 

Jet Area Servo Stroke 

Compressor Inlet Variable Vane Angle 

Rear Compressor Variable Vane Angle 


Symbol 

Sensor Type 

TT2 

Thermocouple 

PT2 

Vibrating Cylinder 

TT25 

Thermocouple 

N1 

Magnetic Pickup 

N2 

Alternator Winding 

PT4 

Vibrating Cylinder 

FTIT 

Thermocouples 

PT6 

Vibrating Cylinder 

AJ 

Resolver 

CIVV 

Resolver 

RCVV 

Resolver 
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In a military configuration, the typical short flight mission may not allow 
adequate time for an accurate diagnosis of control system problems. In addi- 
tion, the increased complexity of the high performance control system required 
for an application such as the FIDO engine can often result in misdiagnosis of 
system problems. Since the component is charged with a failure when it is 
removed and replaced, a misdiagnosis problem may unjustifiably increase the 
failure rate of an individual component in military records. In addition, the 
temperature and vibration environment experienced with a military application 
are more severe than with a commerical application. Therefore, the failure 
rates may differ from those recorded for commercial control systems. 

The sensor failure rates were broken down into the predominant failure cate- 
gories of out-of-range, drift, and noise. The failure category of noise 
consists of all unconfirmed in-range intermittent failures. Block diagrams of 
the sensor configurations and their associated failure rates are shown in 
Figures 6 through 10 and summarized in Table II. The predominant causes of 
in-range sensor failures are presented in Appendix A. 

As shown on Table II, the total failure rate for one complete set of sensors 
required for the multivariable control application is 406 failures per million 
hours. To put this number in perspective, the failure rate of a total multi- 
variable control system (including all control components such as pumps, igni- 
tion system, actuators, etc.) with sensor hardware redundancy is 3706 failures 
per million hours. By replacing one set of the redundant sensors with analy- 
tical redundancy (advanced concepts), the total system failure rate would be 
reduced from 3706 to 3300 failures per million hours. Therefore, incorporating 
advanced concepts to detect, isolate, and accommodate sensor failures has a 
potential for reducing the total control system failure rate by approximately 

m. 


TABLE II 

SENSOR FAILURE RATES 


Sensor 

Failure Rate/ 
Million Hours 

Out of 
Range 

Drift % 

Noi 

N1 

22 

93 

1 

6 

N2 

22 

80 

10 

10 

TT2 

43 

87 

12 

1 

FTIT 

222 

20 

79 

1 

PT2 

18 

89 

10 

1 

PT6 

18 

89 

10 

1 

Pb 

18 

89 

10 

1 

TT2.5 

43 

87 

12 

1 


406 
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N1 SENSOR 


N1 SENSOR N1 INTERFACE 



N1 SENSOR AND CABLE 
A‘ = 17/MILLlON HOURS 
OUT-OF-RANGE = 94% 

TOTAL SYSTEM 

N1 INTERFACE 
\ = 5/MILLION HOURS 
OUT-OFRANGE = 90% 

DRIFT 

= 0% 

A = 22/MILLION HOURS 

DRIFT 

= 5% 

NOISE 

= 6% 

MTB = 45,454 

NOISE 

= 5% 


*A = FAILURE RATE IN TERMS OF NUMBER OF FAILURES PER MILLION OPERATIONAL HOURS 


Figure 6 


N1 Sensor configuration 





N2 SENSOR 


N2 SENSOR N2 INTERFACE 



N2 SENSOR AND CABLE 


N2 INTERFACE 


A* = 17/MILLION HOURS 

OUT-OF- RANGE = 80% 
DRIFT = 10% 

NOISE = 10% 


TOTAL SYSTEM 

A= 22/MILLION HOURS 
MTB = 45,454 


JL= 5/MILLION HOURS 

OUT-OF-RANGE = 90% 

DRIFT = 5% 

NOISE = 5% 


•A = FAILURE RATE IN TERMS OF NUMBER OF FAILURES PER MILLION OPERATIONAL HOURS 


Figure 7 N2 Sensor configuration 

TT2 SENSOR 


TT2 SENSOR DC INTERFACE 



TT2 SENSOR AND CABLE 



rr2 INTERFACE 


X= 33/MILLlON HOURS 


TOTAL SYSTEM 

10/MILUON HOURS 


OUT-OF-RANGE 

= 90% 


OUT-OF-RANGE 

= 75% 

DRIFT 

= 10% 

^ = 43/MILUON HOURS 

DRIFT 

= 20% 

NOiSE 

= 0% 

MTB = 23^ 

NOISE 

» S% 


*A = FAILURE RATE IN TERMS OF NUMBER OF FAILURES PER MILUON OPERATIONAL HOURS 

Figure 8 TT2 Sensor configuration 
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FTIT SENSOR 


FTIT SENSOR DC INTERFACE 



FTIT SENSOR AND CABLE 


FTIT INTERFACE 


\= 212/MILLION HOURS 

OUT-OF-RANGE = 18% 

DRIFT =82% 

NOISE = .0% 


TOTAL SYSTEM 

X = 222/MILLION HOURS 
MTB = 4500 


X= 10/MILLION HOURS 

OUT-OF-RANGE =75% 

DRIFT =20% 

NOISE = 5% 


•A = FAILURE RATE IN TERMS OF NUMBER OF FAILURES PER MILLION OPERATIONAL HOURS 


Figure 9 FTIT Sensor configuration 

PT4 SENSOR 


PROBE SENSOR INTERFACE 



CLOCK 


PROBE AND SENSOR 



INTERFACE 

X= 11 /MILLION HOURS 


TOTAL SYSTEM 

A= 7/MILLION HOURS 

OUT-OF-RANGE 

88% 


OUT-OF-RANGE 

DRIFT 

11% 

A = 18/MILLION HOURS 

DRIFT 

NOISE 

1% 

MTB = 55,000 

NOISE 


•A = FAILURE RATE IN TERMS OF NUMBER OF FAILURES PER MILUON OPERATIONAL HOURS 


Figure 10 PT4 Sensor configuration 
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3.3 FAILURE MODE AND EFFECTS CRITICALITY ANALYSIS 


3.3.1 Introduction 

An engine sensor Failure Mode and Effects Criticality Analysis (FMECA) was 
conducted with the objective of dividing the sensor set into critical and 
non-critical sensors. This allows proper emphasis to be placed upon developing 
concepts which can provide good detection, isolation and accommodation of 
failures of critical sensors. 

A list of the required engine sensors and sensor types was compiled for FI 00 
Multivariable Control (MVC) application as described in Section 3.2 The sensor 
types were selected to satisfy the accuracy and environmental requirements of 
the system. Using this selected sensor set, sensor failure characteristics 
were defined, including modes of failure, such as drift, out-of-range fail- 
ures, and a failure category referred to as noise, which includes unconfirmed 
in-range intermittent failures. The magnitude of allowable sensor drift and 
the failure rates for the different failure modes were also determined during 
this study. 

The impact of these sensor failure characteristics was evaluated on the non- 
linear dynamic simulation of the FIDO multivariable control system. This 
evaluation was accomplished at the fifteen (15) flight operating points selec- 
ted for the detection, isolation, and accommodation concept evaluation to 
determine the impact on steady state and transient engine performance. 

3.3.2 Impact of Out-of-Range Failures on Steady State Operation 

Computer analysis, using the detailed nonlinear FIDO multivariable control 
simulation, was conducted to determine the effects of out-of-range sensor 
failures on gas generator operation. Out-of-range sensor failures for each 
input sensor were simulated at the flight operating points by individually 
failing the sensors to their high and low range limits, and observing the 
steady state results. The results of this study are shown in Appendix A. 

All out-of-range failures can exhibit critical failure characteristics at some 
of the flight operating points. Critical failures were defined as failures 
that result in a fan or compressor surge, excessive thrust variation (greater 
than 10%), or a rotor over speed above the operating limits. 

3.3.3 Impact of In-Range Sensor Failures on Steady State Operation 

The impact of in-range sensor failures on steady state operation was also 
evaluated on the nonlinear simulation. As previously discussed, an in-range 
sensor failure can result in sensor drift anywhere between the accuracy of the 
sensor to the out-of-range limit. Therefore, a study was conducted to examine 
various levels of drift at each flight operating point, for each sensor, to 
determine the minimum drift which would cause a critical failure situation; 
i.e., the minimum drift that a detection, isolation and accommodation algo- 
rithm must be capable of detecting. The flight operating points reflect those 
conditions which exhibit the most severe consequences to out-of -range fail- 
ures. The results are summarized in Table III. 
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TABLE III 


MINIMUM SENSOR DRIFT FOR A CRITICAL FAILURE SITUATION 


Sensor 

Flight Operating Points 

Minimum Drift 
1% of Point) 

N2 

20K ft/.30Mn, 83" PLA 

3.4% (423 rpm) 

T2 

lOK ft/.9Mn, 83" PLA 

74% (76"F) 

PT2 

0 ft/1.2Mn, 83" PLA 

16.9% (6 psi) 

PT6 

0 ft/OMn, 20" PLA 

113% (18 psi) 

FTIT 

65K ft/2.5Mn, 83" PLA 

2.7% (45"F) 

PT4 

0 ft/OMn, 83" PLA 

22% (80 psi) 

T25 

0 ft/OMn, 20" PLA 

70% (70"F) 


The N1 drifts were not considered in this study, since an in-range failure of 
this sensor is very unlikely (.22 failures/million hours). For a fan turbine 
inlet temperature in-range drift, critical failure characteristics will occur 
for all failures where the sensed temperature drifts to a fixed temperature 
above the control limit. This failure would result in a constant negative 
error term in the protection loop, causing fuel flow to drive down, resulting 
in excessive thrust loss. 

A fan turbine inlet temperature in-range sensor drift could also exhibit 
critical failure characteristics for those failures where the sensed tempera- 
ture drifts to a fixed temperature below the control limit. This failure mode 
would increase fuel flow and produce overtemperaturi ng of the turbine at the 
flight operating points in which the engine normally operates near the 
temperature limit. 

3.3.4 Effect of Operating With Failures During Transient Operation 

Power lever transients were run with out-of-range failures at those flight 
conditions where, in steady state, the failure produced marginally critical 
engine operation. These results showed more severe failure consequences trans- 
iently than in steady state. This reconfirmed the need to evaluate the detec- 
tion, isolation and accommodation algorithms transiently, as well as in steady 
state. An example of transient operation is shown on Figure 11. The dashed 
line on this figure shows the effects on compressor surge margin resulting 
from failing the PT6 sensor out-of-range to its upper limit at idle power. The 
solid line shows the same failure at military power followed by a snap decel 
to idle occurring at five (5) seconds. This illustrates significantly greater 
loss of compressor surge margin during the snap decel to idle than in the 
steady state idle failure case. 

3.3.5 Effects of Intermittent In-Range Sensor Failures 

In-range intermittent sensor failure, which is referred to as noise for the 
purposes of this study, was considered for the failure mode and effects 
criticality analysis. However, upon examining field service data, it was found 


18 



that this failure category encompasses all unconfirmed intermittent failures 
reported mostly by pilot complaint. Therefore, very little quantitative data 
existed which made it very difficult to model. In addition, the failure rates 
for this category were shown to have a low probability of occurrence for the 
pressure and temperature sensors. It was therefore decided not to include this 
failure category in the analysis. 


PLA TRANSIENT 



P6 FAILED HIGH 


Figure 11 Typical Transient Operation - PT6 Sensor Failed Out-of-Range 


3.3.6 Effects of Multiple Failures 

After completing the single failure portion of the failure mode and effects 
criticality analysis, it was obvious that including multiple sensor failures 
would not be a meaningful addition to the study. This became apparent when all 
single sensor failures were shown to exhibit critical failure characteristics. 
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3.3.7 Summary of Results 


A summary of the failure mode and effects criticality analysis results is 
shown in Table IV. This table illustrates that all out-of-range failures 
exhibit critical failure characteristics, where criticality is as defined in 
Section 3.3.2. In-range failures (drifts) of the N2, TT2, TT25, FTIT, PT2, PT6 
and PT4 sensors are also shown to exhibit critical failure characteristics. 
The in-range failure rates of the N1 sensor and the pressure sensors are low. 
For out-of-range failures simple range tests can be used effectively for 
detection and isolation. For in-range failures, however, advanced detection, 
isolation and accommodation algorithms may be required to insure continued 
operation in the event of sensor failures. Therefore, less emphasis could be 
placed on developing in-range failure detection capability for these sensors 
than on the N2 sensor and the temperature sensors. In-range failures of the 
fan turbine inlet temperature sensor were shown to exhibit critical failure 
characteristics for the smallest magnitude of sensor drift, in addition to 
having the highest failure rate. Therefore, this sensor warrants an accurate 
algori thm. 


TABLE IV 
FMECA SUMMARY 


OUT-OF-RANGE FAILURES IN-RANGE DRIFTS 


Sensor 

Failure Rate 
/Mil Hrs 

Failure 
Classif 'n 

Failure Rate 
Failure/Mil Hrs 

Minimum 

Drift* 

Failure 
Classif 'n 

N1 


Cri tical 


-- 

Uni ikely 

N2 

17.6 

Critical 

2.2 

3.4% (423RPM) 

Critical 

TT2 

37.4 

Critical 

5.2 

74% (76'*F) 

Critical 

FTIT 

44 

Critical 

175.4 

2.7% (45“F) 

Critical 

PT2 

16 

Cri tical 

1.8 

16.9% (6 PSD 

Critical 

PT6 

16 

Critical 

1.8 

113% (18.6 PSD 

Critical 

Pb 

16 

Cri tical 

1.8 

22% (80 PSD 

Cri tical 

TT2.5 

37.4 

Critical 

5.2 

70% (70“F) 

Critical 


* This is the minimum sensor drift in terms of % of point for which critical 
engine operation was observed. 

For this program, the detection, isolation and accommodation algorithms were 
developed for the PT6, PT4, N1 , N2, and fan turbine inlet temperature sensors 
to result in a sufficiently complex problem to be a good test of the advanced 
concepts. 

3.4 DETECTION, ISOLATION AND ACCOMMODATION CRITERIA, DETECTION PERFORMANCE, 

AND FIGURES OF MERIT “ 


3.4.1 Detection, Isolation and Accommodation Criteria 

High performance turbine engines, such as the FIDO, operate at or near design 
limits with tight control of speed, pressure, temperature and airflow to 
achieve maximumm performance while maintaining engine durability. Basically, 
control requirements as applied to these engines consist of exhibiting desired 


20 


transient and steady-state responses while remaining within safe margins of 
engine thermal, aerodynamic and mechanical limits throughout flight envelope 
operation. These requirements were combined to create a design criteria list 
to apply in the design of detection, isolation, and accommodation concepts. 

The criteria used in the design of the concepts include the following: 

1. Maintaining critical engine parameter limits 

0 Maximum Fan Turbine Inlet Temperature 

0 Maximum High Rotor Speed 

0 Maximum Low Rotor Speed 

0 Maximum and Minimum Burner Pressure 

2. Maintaining safe fan and compressor surge margins 

3. Minimal steady state deviations from nominal 

4. Acceleration requirement 

0 Minimize time to 90% thrust variation 

0 Minimize overshoot of Engine Pressure Ratio and Low Rotor Speed 

The detection, isolation and accommodation criteria were incorporated in a 
scoring system (as described in Section 3.5 ) to quantitatively evaluate the 
candidate advanced concepts. 

3.4.2 Detection, Isolation and Accommodation Detection Performance 

The detection performance relates to how effective the concept is in detecting 
a sensor failure. For example, if a concept has excellent accommodation 
capacity but cannot consistently detect failures then it is not a good concept. 

The response of the concept in detecting various induced failures was quanti- 
fied in the following terms: Hit; Miss; False Alarm; and Response Time. The 
definitions of these terms are: 


Hit: 

A sensor failure(s) occurs and detection, isolation 
and accommodation are accomplished by the chosen 
concept; 

Mi ss: 

The concept detects no failure(s) for which it was 
programmed despite the fact that such a failure! s) 
was induced. 

False Alarm: 

A condition in which the concept incorrectly 
detects a sensor failure(s) when none has actually 
occurred. 

Response Time: 

Length of time after failure before detection of 
the failure occurs. 
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As with the detection, isolation, and accoirmodation criteria, mathematical 
equations were generated (as described in Section 3.5 ) to quantitatively 
evaluate the detection performance of the candidate advanced concepts. 

3.4.3 Detection, Isolation and Accommodation Figures of Merit 

The DIA figures of merit generated for the evaluation of the candidate con- 
cepts are more qualitative than the DIA Criteria or Detection Performance. The 
figures of merit are defined as the benefits of bettering the detection, 
isolation and accommodation criteria in the event of a single sensor failure 
or meeting the DIA criteria in the event of multiple sensor failures. The DIA 
figures of merit used in evaluating the concepts included the following: 

1. Accommodation of multiple sensor failures 

2. Complexity of software computation and implementation (core size, 
cycle time, control mode interactions and dependence, etc.) 

3. Robustness (sensitivity to model errors) 

4. Sensitivity to noise and disturbances 
3.5 SCORING SYSTEM 


A scoring system was developed for use in evaluation of the candidate detec- 
tion, isolation, and accommodation concepts. The scoring system evaluates each 
concept on how well it detects, isolates, and accommodates sensor failures. 

The accommodation criteria used in developing the scoring system was a set of 
transient and steady state operational requirements which the propulsion 
system must satisfy to meet minimum aircraft operational requirements in the 
event of various potential sensor failures. The accommodation criteria used in 
this study penalizes the concept for: 

1. Exceeding critical engine protection parameter 

0 FTIT limit 

0 N2 speed limit 

0 N1 speed limit 

0 PT4 pressure limit 

2. Decrease in fan compressor surge margins 

3. Steady state accuracy deviations 

4. Acceleration requirement 

0 Excessive time to 90% thrust variation 

0 Excessive Engine Pressure Ratio or Low rotor speed overshoot 
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The DIA detection performance relates to how effective the DIA concept is in 
detecting a sensor failure. This portion of the scoring system evaluates each 
DIA concept on time to detect a failure, the hit/miss ratio, and the number of 
false alarms. 

Mathematical equations were derived which incorporate both the accommodation 
and detection criteria. These are presented in Appendix B. The scoring system 
was used in the initial detection, isolation and accommodation concept screen- 
ing process to select the most desirable concept. The results of the scoring 
of the concepts are shown in Section 4.4. 

3.6 SELECTION OF FLIGHT OPERATING CONDITIONS 

A set of fifteen flight operating points were selected to be used as the eval- 
uation conditions for the selected advanced detection, isolation, and accommo- 
dation algorithm and the baseline parameter synthesis algorithm. These flight 
operating points were chosen to span the F-15 aircraft flight envelope and to 
demonstrate the algorithm detection and accommodation performance at condi- 
tions where critical stability and engine parameter limits are encountered. 
The points were also selected to include, where possible, many of the NASA 
altitude stand test points which were run during previous programs. Table V 
shows the selected flight operating points and the criterion used to select 
the individual conditions. Figure 12 shows the flight operating points rela- 
tive to an F-15 aircraft flight envelope and illustrates that the selected 
conditions span a considerable portion of the engine flight envelope. 

TABLE V 


FLIGHT OPERATING CONDITIONS 


Po i nt 

Mach 

Number 

A1 titude 
X lO-^Ft 

PLA 

Selection Criterion 

1 

0.0 

0 

20 

Sea Level Operating Line 

2 

0.0 

0 

83 

Sea Level Operating Line 

3 

0.0 

0 

130 

Sea Level Operating Line 

4 

1.2 

0 

83 

Max T4, q, PT4, N1 , N2, P2 

5* 

0.9 

10 

83 

Max T4 

6 

0.3 

20 

24 

Lower PT4 Limit 

7 

0.3 

20 

83 

Fan Stability Verification 

8* 

1.8 

24 

83 

Max Nl, T3, T4 

9* 

1.9 

34 

83 

T4 Limit, Compressor Stability 

10* 

0.9 

45 

40 

Min PT4, Low Power Altitude Operation 

11* 

0.9 

50 

83 

Rating Point 

12 

2.2 

54 

130 

Supersonic Cruise 

13 

1.2 

65 

83 

Fan Stability Verification 

14 

2.5 

65 

83 

Compressor Stability Verification 

15 

2.5 

65 

130 

Max Augmentation 


♦NASA test points 
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• Pt 13 


Pts 14. 15 



Figure 12 Selected Flight Operating Conditions 



Section 4.0 


CONCEPT FORMULATION 

A survey was made of the available Detection, Isolation, and Accommodation 
techniques as described in technical literature. Five advanced sensor failure 
concepts, applicable to gas turbine engines, were formulated from the results 
of the survey. A simplified engine model was developed and used as a testbed 
for screening the candidate concepts. Various test cases were run to quantita- 
tively evaluate the candidate concepts using the scoring system developed in 
section 3.5. This resulted in the selection of one concept for detailed 
evaluation. The detailed evaluation will be discussed in Section 5. 

As a parallel effort to the development of the advanced detection, isolation 
and accommodation concepts, a baseline detection, isolation and accommodation 
algorithm was developed based upon conventional parameter synthesis techni- 
ques. The parameter synthesis based algorithm was evaluated in the same manner 
as the selected advanced detection, isolation and accommodation algorithm to 
provide a basis of comparison (as discussed in Section 6). 

The development of the parameter synthesis concept, the simplified engine 
model, and the five selected advanced detection, isolation and accommodation 
concepts will be discussed in the following paragraphs. 

4.1 PARAMETER SYNTHESIS 


A sensor failure detection, isolation, and accommodation algorithm was devel- 
oped based upon conventional parameter synthesis techniques. This algorithm 
was used as a baseline for comparison with the selected advanced algorithm. 
Comparing the performance of the two algorithms shows the value of using ad- 
vanced concepts for production control systems. If the advanced DIA concept is 
of similar complexity to the parameter synthesis technique, but yields signi- 
ficantly better detection, isolation, and accoimiodation of failed sensors, 
then it would be desireable for implementation in production control systems. 
The results of this comparison are presented in Section 5. 

The concept of parameter synthesis uses engine component relationships to com- 
pute synthesized values of measured parameters from other measured parameters. 
Generating these synthesized values provides the information to detect, iso- 
late, and accommodate sensor failures. The following paragraphs describe the 
development of the engine component relationships and the design of the logic 
used to detect and isolate sensor failures. 

Engine component relationships of the FIDO engine were studied to obtain a set 
of curves potentially capable of synthesizing other measured parameters within 
the control system. The FIDO engine and Multivariable Control (MVC) nonlinear 
simulation was programmed to run steady-state engine operating data from idle 
to full afterburner power at the flight operating conditions chosen for this 
study. Over sixty viable engine component relationships were computer plotted 
for all flight operating conditions to provide composite plots of the various 
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relationships. These plots were examined to eliminate those which did not form 
a relatively unique curve or a family of curves related by a bias measured 
within the control system, i.e., it is desireable to use simple curves to keep 
the algorithm complexity to a minimum. The remaining engine component rela- 
tionships were judged for ease and accuracy of implementation, transient 
accuracy, and engine to engine variations and deterioration effects to arrive 
at the final curve set shown in Figure 13. 

These engine component relationships can be used to detect, isolate, and 
accommodate PT6, PT4, N1 , N2 and FTIT sensor failures. The detection and 
isolation functions are performed by comparing the difference between the 
synthesized values and measured values to predetermined tolerance bands; one 
or more of the synthesized values being out of tolerance with the measurements 
indicates (detects) a sensor failure. 

The tolerance bands used for this study were derived by summing the produc- 
tion/deterioration variation of the relationship with the curve read inaccur- 
acies. The production/deterioration portion of the tolerance band was derived 
by computer plotting actual engine data from sea level engine tests of seventy 
recent production engines in the same format as the parameter synthesis 
curves. This was done at five part power points to observe if the data scatter 
varies with power level. The tolerance bands were sized based upon a 2 sigma 
statistical variation applied to the results in units of the Y-Axis. Figure 
14, is representative of the production/deterioration tolerance used for a 
typical parameter synthesis curve. The tolerance band arrived at by summing 
this production/deterioration spread with the curve read inaccuracies are as 
f ol 1 ows : 

Curve 1 
Curve IB 
Curve 2 
Curve 3 
Curve 4 
Curve 5 

These tolerance bands are increased by 50% during a power lever transient to 
avoid false alarms. 

Logic was developed to incorporate the curve set and associated tolerance 
bands into a viable detection, isolation and accommodation concept, as shown 
in Figure 15 through 18. The failure detection logic, as shown in Figure 15, 
determines the general health of the five engine sensors. A comparison of the 
absolute value of the difference between the sensor measurements (Xsen(n)) and 
the corresponding synthesized value (Xsyn(n)) to the associated tolerance band 
is used to create a sensor fault word. This word varies uniquely between 0 to 
31 depending on which curve or combination of curves are out of tolerance with 
their corresponding sensor measurements. 

The sensor fault word is a 5 bit binary word, each bit being associated with 
one of the parameter synthesis curves. If a particular curve is out-of- 
tolerance, the polarity of the bit corresponding to the out-of-tolerance curve 


— 0.15 PT4/PT2 

— 0.15 PT4/PT2 

— 300 RPM N2/V6ITT2 

— 0.35 PT6/PT2 

— 500 RPM Nl/V0Tf2 

— 150°F FTIT 


26 



CURVE 1 


CURVE IB 


PT4 SYNTHESIS 


N2 SYNTHESIS 


PT6 SYNTHESIS 


N1 SYNTHESIS 


Figure 13 Final 



N2C2 





N2C25 


FTIT 

SYNTHESIS 



Curve Set for the Parameter Synthesis Algorithm 
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CURVE OUTPUT 





Figure 14 Typical Production Tolerance and Deterioration Bandwidth on a Para 
meter Synthesis Curve 





Figure 15 Parameter Synthesis Detection Logic 
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changes from 0 to 1 . The value of the binary bits that are set are then 
arithemetically summed to create the fault word. The calculation of the fault 
word is shown in Table VI. 

If the fault word is zero, all curves are in tolerance with the sensor meas- 
urements, and, no failures are detected. A non-zero fault word indicates a 
sensor failure which requires exercising the isolation logic to pinpoint the 
failure to a particular sensor. The isolation and accommodation logic, as 
shown in Figures 16 and 17, compares the fault word (FLSUM) to a set of known 
fault words which are uniquely associated with particular sensor failures. The 
set of known fault words used to isolate the failure to a particular sensor 
measurement is shown in Table VII. 


TABLE VI 



PARAMETER 

SYNTHESIS FAULT WORD 

CALCULATION 


Bit Number 

1 

2 

3 

4 

5 




— 

““ 


Bit Value 

For Out-of-Toler- 

ance Curves 

1 

2 

4 

8 

16 

Associated 

Curve 

Curve 1 

Curve 2 

Curve 3 

Curve 4 

Curve 5 


Bit 5 

Where: Fault word = 53 Bit values 

Bit 1 


Note: If the curve is not out-of- tolerance with the sensor measurements; i.e., 
the bit polarities are all 0, the value of the bits are zero. For a no failure 
case, the fault word =0. 


TABLE VII 


PARAMETER SYNTHESIS FAULT WORD ISOLATION SET 


Sensor Measurement 


Value of Known Fault Word 


N1 

N2 

PT4 

PT6 


1 

3,7,15,23,31 
10 . 8 
4 


FTIT 


16 
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If the fault word generated is identical to one of the known fault words, the 
failure has been isolated to a given sensor and the sensed value is tempor- 
arily set equal to the synthesized value. A verification of the isolation 
validity is conducted for the next 1.0 second. The detailed verification logic 
is shown in Figure 18. 

Blocks 1 and 2 in Figure 18 implement a counter to record the number of times 
a particular sensor has been isolated as a failed measurement during a flight 
or mission. This logic will permanently latch a sensor as failed if an inter- 
mittent failure occurs more than 100 control computation cycles. (This is 
based upon a 0.01 second computation cycle for the nonlinear simulation.) 
Blocks 3 and 4 delay further isolation verification for 0.2 second during 
which time any transient resulting from the switch over from sensed to synthe- 
size would decay significantly. After the 0.2 second delay, if the failure was 
isolated properly, the fault word should be zero. A non-zero fault word 
indicates that the failure was incorrectly isolated and operation is reverted 
to the sensed measurements. If the fault word is zero for the next 0.8 
seconds, the sensor failure has been properly isolated and the permanent 
failure flag is set for the failed sensor. If the failure fault word is 
non-zero during the 0.8 second interval, the failure was either incorrectly 
isolated or intermittent in nature. This logic assumes that a second failure 
would not occur during the one second time interval. 

Once the permanent failure flag has been set, the parameter associated with 
the failed sensor is permanently set equal to the synthesized value, as shown 
on Figure 18. After the failure is permanently accommodated, the logic is 
reconfigured for second failure detection, isolation and accommodation 
capability. The reconfiguration process involves increasing tolerance bands 
and modifying the known fault words (FLSEN(k)) to account for the loss of the 
input signal. 

The parameter synthesis logic was programmed in the FIDO MVC simulation and 
was exercised over the selected flight operating conditions. Figures 19 and 20 
show an example of the parameter synthesis algorithm response to an N1 sensor 
failure. The failure was simulated at sea level static, intermediate power and 
was induced at a time of 3.0 seconds. These figures show only a minor trans- 
ient occurring when switching from sensed measurements to synthesized, with a 
minimal loss in steady state accuracy (-55. pounds loss in thrust). The 
detailed analysis of the parameter synthesis algorithm performance is included 
in Section 5. 

4.2 SIMPLIFIED ENGINE MODEL 


4.2.1 Introduction 

A full envelope simplified nonlinear model of the FIDO engine is required for 
two reasons when developing, evaluating, and implementing fault detection, 
isolation and accommodation (DIA) concepts. First, all of the techniques 
investigated in this program employ filters which require a real time micro- 
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processor implemented engine model. A simplified model minimizes hardware 
requirements. Second, evaluating the concepts involves many computer runs of 
an engine simulation. Using a simplified model (rather than a full nonlinear 
dynamic deck) during the initial evaluation process can greatly reduce cost. 

A procedure for generating a full envelope, simplified nonlinear engine model 
is presented in this section. This model is developed from steady state opera- 
ting line data and linear dynamic models generated about that operating line. 

The simplified model generation procedure is summarized in Figure 21. Linear 
dynamic model generation techniques are described in detail in Reference 1 and 
summarized in Appendix C. Model reduction procedures, for reducing the number 
of state variables, are described in Reference 4 and summarized in Appendix D. 

The form of the resulting model is shown in a block diagram in Figure 22, and 
described with the equations, 

X = F(X-Xss) (1) 
where 

Xss = Xb - F-lG-(U - Up) 


and 


Y = Yb + H.(X - Xp) + D*(U - Ub) 

Here the state derivative, X, is being driven by the distance the state, X, is 
from its steady state value » ^ss* The subscript, b, denotes a base point 
obtained from the original steady state operating line data. 

This model looks much like a linear model. Note, however, that the model 
matrices (F, F"^G, H and 0) are functions of the operating condition as are 
the base points (Xp, Up, and Yp ). In general, the matrices used are 
formed by scheduling linear model matrices throughout the flight envelope. The 
base points are equivalent to the operating line data. 

Section 4.2.2 presents a review of the original sixteenth order linear models, 
the simplified linear models, and the generation of the simplified nonlinear 
models. Section 4.2.3 discusses model validation. 

4.2.2 Simplified Nonlinear Model Development 

4. 2. 2.1 Engine Linear Models 

The FIDO nonlinear dynamic engine simulation was used to develop the steady 
state operating line data and linear engine models. Sixteenth order linear 
models were generated by Pratt and Whitney Aircraft Group using a full FIDO 
nonlinear simulation during the FIDO Multivariable Control Program (Contract 
F33615-75-C-2053) . A description of the procedure and a complete set of 
dynamic models is listed in reference 3. 
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Figure 21 


Development of A Simplified Nonlinear Model From Reference 
Schedules and Reduced Order Linear Models 



Figure 22 Simplified Nonlinear Model Implementation 
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MACH SUMBER 


Figure 23 Relative Linear Model Operating Point Location Relative to the F-15 
Aircraft Flight Envelope 



Table VIII lists the state, input and output variables which constitute these 
linear models. Table IX lists the linear model operating points. Figure 23 
shows the F-15 aircraft operating envelope spanned by the chosen set of 
linearization points. 


TABLE VIII 

ENGINE VARIABLES USED IN LINEAR MODELS 
1. Engine State Variables 2. Engine Inputs 


Xi = Fan Speed, SNFAN U] 

( N] ) - rpm 

X2 = Compressor Speed, SNCOM U2 

(N2) - rpm 

X3 = Compressor Discharge Pressure, U3 

Pt3 - psia 

X4 = Interturbine Pressure, U4 

Pt4.5 - psia 

X5 = Augmentor Pressure, P^y^ - U5 

psia 

X5 = Fan Inside Diameter Discharge 


Temperature T^2,5h ~ 

Xy = Duct Temperature,*Tt2.5c ~ 

Xs = Compressor Discharge Temperature, 

Tt3 - 

Xg = Burner Exit Fast Response Temper- 
ature, T-j-4hi - °R 

X-jo = Burner Exit Slow Response Temperature, 
TtA 10 

X-ji = Burner Exit Total Temperature, 

Tt4 - ‘’R 

X]2 = Fan Turbine Inlet Fast Response 
Temperature, T^4.5hi - °R 

X-)3 = Fan Turbine Inlet Slow Response 
Temperature, Tt4^5io - 

Xi4 = Fan Turbine Exit Temperature, 

Tt5 - “R 

X-|5 = Duct Exit Temperature, T^gj.- °R 

X-|g = Mixed Exhaust Stream 

Temperature, T^y^, - "R 


= Mam Burner Fuel Flow, WFMB - 
Ib/hr 

= Nozzle Jet Area, Aj - ft^ 

= Compressor Fan Inlet Variable 
Vane, CIVV - deg 
= Rear Compressor Variable Vane, 
RCVV - deg 

= Customer Compressor Bleed Flow, 
BLC - % 


3. Engine Outputs 

Y-] = Engine Net Thrust Level, FN - lb 
Y2 = Total Engine Airflow, WFAN - 
Ib/sec 

Y3 = Turbine Inlet Temperature, T^4 
Y4 = Fan Stall Margin, SMAF 
Y5 = Compressor Stall Margin, SMHC 
Yg = Fan Exit A P/P, (Pt2.5 “ 

PS2.5)/Ps2.5»*^®s®^ on test data 
Yy = Fan Exit A* P/P, (Pt2,5 “ 

PS2.b)/Rs2.5 theoretical function 
of area and airflow 
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TABLE IX 


LINEAR MODEL OPERATING POINTS 





ALTITUDE 



CODE 

POINT 

NO. 

MACH 

NO. 

FT. 

(000) 

PLA 

(DEG) 

COMMENTS 

Basic 

1 

0 

0.0 

20 


Set 

2 

0 

0.0 

36 



3 

0 

0.0 

52 

Sea Level Static Operating Line 

4 

0 

0.0 

67 


5 

0 

0.0 

83 


Group I 1 

0 

0.0 

24 

Additional Unchoked Model 

2 

0.9 

10.0 

83 

Performance at Max. TT4 

3 

0.3 

20.0 

24 

PT4 Lower Limit 

4 

0.6 

10.0 

20 

Unchoked Model Behavior 

5 

0.6 

30.0 

24 

Unchoked Model Behavior 

Group II 6 

1.2 

0.0 

83 

Maximum q, PT4, N1 , N2, TT4 

7 

2.2 

40.0 

83 

TT3, TT4 Limit, Compressor Stab 

8 

0.9 

45.0 

130 

Low Augmentor Pressure 

9 

0.9 

65.0 

83 

Fan Stability 

10 

2.5 

65.0 

130 

Maximum Augmentation 

Extra(E) 1 

0.9 

10.0 

36 


2 

0.9 

10.0 

52 


3 

0.9 

10.0 

67 


4 

0.9 

10.0 

83 

Additional Operating Line 

5 

0.9 

30.0 

36 

Data for Engine Test 

6 

0.9 

30.0 

52 


7 

0.9 

30.0 

67 


GroupIII 1 

0.0 

0.0 

20 

Minor Deck Modification 

2 

0.0 

0.0 

20 

With BLD/HPX Extraction 

3 

0.0 

0.0 

83 

Minor Deck Modification 

4 

0.9 

10.0 

20 


5 

0.9 

30.0 

20 

Additional Operating Line 

6 

0.9 

30.0 

83 

Data for Engine Test 

Group IV 1 

0.9 

45.0 

83 

Rating Point 

2 

0.9 

45.0 

52 

Altitude Part Power Point 

3 

0.9 

45.0 

40 

Minimum Burner Pressure 

4 

1.8 

75.0 

83 

Low Density, Reynolds Index 

5 

1.8 

20.0 

83 

Maximum N1 , TT3, TT4 

6 

0.3 

20.0 

83 

Fan Stability 

7 

1.8 

40.0 

83 

TT4 Limit, Compressor Stab. 

8 

2.5 

65.0 

83 

Compressor Stability 

9 

2.15 

58.5 

83 

PT2, TT2 Coverage 
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4. 2. 2. 2 Reduced Order Linear Models 


Simplified linear models were generated using the 16th order linear models and 
reducing the order of the system. A modal decomposition method was utilized 
for this purpose. A detailed description of this method is given in Appendix 
D. The reduced order models were then scheduled against engine parameters to 
obtain a simplified model operable over the entire flight envelope. 

The reduction process allows important dynamic modes to be retained and 
important, measureable quanitities to be included as state variables in the 
system of equations. Four states which represented imporant engine parameter 
dynamics, were chosen as a result of dynamic response analysis. Table X lists 
the states and input and output variables which constitute the reduced order 
models. The two rotor speeds are an important part of engine dynamics at each 
flight condition. The other two states are slow response modes and lie within 
the bandwidth of interest. 


TABLE X 


ENGINE VARIABLES USED IN REDUCED ORDER MODELS 


1 . Engine State Variables 


2. Engine Inputs 


X] = Fan Speed, SNFAN (Ni) - rpm 

Xg = Compressor Speed, SNCOM (Ng) - rpm 

X 3 = Burner Exit Slow Response Temperature, 
Tt41o - 

X 4 = Fan Turbine Inlet Slow Response Temper 
ature, Tt4.51o-”R 


U] = Main Burner Fuel 
Flow, WFMB - Ib/hr 
Ug = Nozzle Jet Area, 

Aj - ft2 

U 3 = Compressor Inlet 
Variable Vane, 
CIVV-deg 

U 4 = Rear Compressor Vari- 
able Vane, RCVV-deg 
U 5 = Customer Compressor 
Bleed Flow, BLC - % 


3. Engine Outputs 

Yi = Fan Speed, SNFAN (Ni) - rpm 

Yg = Compressor Speed, SNCOM (Ng) - rpm 

Y 3 = Burner Pressure, PT4 - psia 

Y 4 = Augmentor Pressure, PT 6 - psia 

Y 5 = Fan Turbine Inlet Temperature, FTIT - *R 


The simplified model must include burner pressure for use in the maximum and 
minimum burner pressure limiting loops in the control mode. However, the bur- 
ner pressure flow dynamics have a time constant always less than 0.01 sec. 
Therefore, burner pressure is included only as an output variable, i.e., as a 
linear combination of the chosen state variables. Similarly, augmentor pres- 
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sure is required for calculating engine pressure ratio (EPR), but its associa- 
ted time constant is small. Therefore, it is only included as an output vari- 
able. The maximum temperatures specified for compressor discharge and turbine 
inlet stations in the gas path are implicitly limited in the control mode by 
limiting the maximum fan turbine inlet temperature. Thus, Fan Turbine Inlet 
Temperature (FTIT) is also included as an output. 

4. 2. 2. 3 Simplified Nonlinear Model 

The simplified, reduced order linear models discussed above were used to 
generate a simplified nonlinear model to operate over the flight envelope. 
Elements of the linear model matrices were scheduled using engine variables 
and ambient parameters. 

The reduced order linear model is given by 

8X = F . 6X + G-6 U (2) 

8Y = H • 8X + D -6U (3) 

where 6X, 6U, and 6Y are perturbational quantities given by 

6X = X - Xb 

6U = U - Ub (4) 

6Y = Y - Yb 


The quantities Xb, Ub, and Yk are the steady state equilibrium points 
(base points) about which the small perturbation assumption is valid. 

An alternative representation of a linear model can be written as follows. In 
steady state X = 0, so that equation (3) becomes 

0 = F-SXss + 6’SUss 
8Xss = - F-1 g.8Uss 
or Xss = Xb - F-1G‘(U - Ub) 

Using equations (4) and (5), equations (2) and (3) can be written as 
X = F*(X - Xss) 

Y = Yb + H-(X - Xb) + D*(U - Ub) (7) 

X«s is defined as the reference schedule of the states given the control, 
when the system is in equilibrium. This formulation is valid if it is assumed 
that U(t) is piecewise constant on an interval [NT, (N + 1) t] . The time 
interval T can be made small relative to the dynamics so that the constant 
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control assumption is valid. Equations ( 6 ) and (7) is an accurate model only 
if 8 X and 8 U are small. In steady state if the control reaches the base 
point; i.e. U = Ub, then it is guaranteed that the state and outputs will 
reach their base points, i.e. X = X 5 and Y = Y 5 . This is true independent 
of F, F“1 g, H, and D provided F is stable. 

The implementation of this simplified nonlinear model for operation over the 
flight envelope involves scheduling system matrices F, F"1 g, H, and D used 
inequations (5) thru (7). These matrices were scheduled as a function of 
ambient and engine variables. The ambient variables used were engine inlet 
total pressure (PT2) and temperature (TT2). The engine variables were low and 
high rotor speeds (Nl, N2), burner and augmentor pressures (PT4, PT 6 ), and 
compressor inlet and fan turbine inlet temperatures (TT25, TT45) . A regression 
analysis was used to produce polynominal functions which fit the model matrix 
elements with operating variables. A typical matrix element looked like the 
following. 

F (i,j) = ai (N1)3 + 32 (PT4 * PT 6 ) +....+ a,, ( 8 ) 


The number of terms in a model depended on the accuracy of the model desired. 
Polynominal s for the matrix elements were generated using regression analysis 
software available in Systems Control Incorporated's software library. 

Values for the engine variables used in the polynominal s and the base point 
vectors X 5 , 85 ,' and Yjj, were obtained from the steady state reference 
point schedules and the reference transition control in the Multivariable 
Control logic. The transition control in this logic essentially provides a 
"reasonable transient reference" for the linear quadratic regulator control to 
"regulate to". The transient low rotor speed reference from this transition 
control was used as the basic reference for the simplified model base point 
inputs and polynominal parameters. This was accomplished by reading the low 
rotor speed versus power lever angle steady state reference schedule "back- 
wards" to define a power lever angle, or "virtual power code", corresponding 
to the trajectory value for low rotor speed. The "virtual power code" is then 
used to read all of the steady state reference schedules to obtain the base 
point references, Xjj, Ujj, and Yk, and other engine variables required 
for the simplified nonlinear model calculations. Figure 24 presents the 
overall procedure. The fact that the base points and the system matrices vary 
as a function of operating conditions makes the engine model nonlinear. 

4.2.3 Model Validation 

The simplified engine model is incorporated in the filters employed by the 
various detection, isolation and accommodation concepts. The model was there- 
fore implemented in the filter for validation. Filter gains were designed 
using simplified linear models at selected points in the envelope. These 
points correspond to the points at which regulator gains were designed for the 
FIDO multivariable control. These filter gains were also scheduled against the 
ambient and engine variables over the flight envelope. 
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MODEL 


BASE 
POINTS 
Xb- Yb, Ub 


Figure 24 Scheduling of Base Points and Matrices for the Simplified Nonlinear 
Engine Model 


The model validation was performed at the 15 selected flight operating points 
on the envelope. Figures 25 thru 33 show examples of the performance of the 
Kalman filters incorporating the simplified nonlinear model compared with the 
engine output. 

While performance of the combined filter/model algorithm was quite good at the 
lower altitude and mach number flight conditions, some problems of steady 
state and transient mismatch were encountered at higher altitudes and mach 
numbers. These problems were found to result from not having a sufficient 
number of the original linear models available to constrain the curve fitting 
procedure for the matrix elements at these flight conditions to obtain a good 
accuracy of fit. Even though the Kalman filters did a commendable job of 
minimizing these mismatches, the effectivness of the detection, isolation and 
accommodation algorithms was reduced at these flight conditions. Additional 
work is required to generate more linear models and improve the curve fits for 
the simplified nonlinear models. 

4.3 FORMULATION OF ADVANCED CONCEPTS 

4.3.1 Introduction 

A generalized form of a' closed loop control system including sensor fault 
detection, isolation, and accommodation is shown in Figure 34. The system 
plant, actuators, and sensors are in the feedforward loop. All computations 
are performed in the feedback loop. These computations include evaluations of 
the commanded control, estimation of states, and detection, isolation, and 
accommodation of failures. 
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PT4 (PSIA) 



Figure 25 Actual and Estimated Fan Speeds (Flight Condition: Altitude = 0 
Ft., Mach No. = 0, PLA Step From 20“ to 83“ at t=0.0 Seconds) 



Figure 26 Actual and Estimated Burner Pressures (Flight Condition: Altitude = 
0 Ft., Mach No. = 0, PLA Step From 20“ to 83“ at t=0.0 Seconds) 
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Figure 27 Actual and Estimated Fan Turbine Inlet Temperature (Flight 
Condition; Altitude = 0 Ft., Mach No. = 0, PLA Step From 20“ to 83“ 
at t=0.0 Seconds) 



Figure 28 Actual and Estimated Fan Speeds (Flight Condition: Altitude 
20,000 Ft., Mach No. = 0.8, PLA Step From 20“ to 83“ at t=0. 
Seconds) 
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Figure 29 Actual and Estimated Burner Pressures (Flight Condition: Altitude = 
20,000 Ft., Mach No. = 0.8, PLA Step From 20“ to 83“ at t=0.0 
Seconds) 



TINE (SECS) 


Figure 30 Actual and Estimated Fan Turbine Inlet Temperature (Flight 
Condition: Altitude = 20,000 Ft., Mach No. = 0.8, PLA Step From 20“ 
to 83“ at t=0.0 Seconds) 
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PT4 (PSIA) 



Figure 31 Actual and Estimated Fan Speeds (Flight Condition: Altitude = 
45,000 Ft., Mach No. = 0.9, PLA Step From 83“ to 20“ at t=0.0 
Seconds) 



Figure 32 Actual and Estimated Burner Pressures (Flight Condition: Altitude = 
45,000 Ft., Mach No. = 0.9, PLA Step From 83“ to 20“ at t=0.0 
Seconds) 






Figure 33 Actual and Estimated Fan Turbine Inlet Temperature (Flight 
Condition: Altitude = 45,000 Ft., Mach No. = 0.9, PLA Step From 83 
to 20“ at t=0.0 Seconds) 


PROCESS SENSOR 

NOISE NOISE 



Figure 34 Generalized Block Diagram of Failure Detection, Isolation and 
Accommodation Logic 
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A spectrum of techniques for detecting, isolating and accommodating sensor 
failures have been reported in the literature (Reference 6 is a good summary 
article). This section contains a description of five detection, isolation, 
and accommodation strategies that were formulated during this program. The 
details of these concepts were developed specifically for the aircraft turbine 
engine system. Presented first is an overview of the general concepts from 
which a specific technique may be derived. This is followed by detailed dis- 
cussions of the five concepts developed for this program. 

4.3.2 Overview of Existing Techniques 

Advanced techniques for detecting, isolating and accommodating sensor failures 
make use of classical statistical inference calculation and hypothesis testing 
applied to modern estimators and filters, and analytical redundancy available 
in unlike sensor channels. Table XI lists several viable techniques. Some of 
these techniques are capable of detection, isolation and accommodation, while 
others are only capable of one or two parts. Some techniques share a degree of 
commonality. Thus, individual techniques or combinations of techniques can be 
considered for formulating concepts. 

TABLE XI 

TECHNIQUES FOR DETECTION, ISOLATION, AND ACCOMMODATION 

0 Bank of Kalman Filters 

0 Failure Sensitive Filters 

0 Observers 

0 Voting Techniques 

0 Innovations Testing 

0 Modified Kalman Filters 

0 Parameter Estimation 

0 Jump Processes 

This section reviews several detection, isolation, and accommodation tech- 
niques. All of these are based on the redundancy of information in unlike 
sensor channels (analytical redundancy). Traditional schemes of voting between 
redundant sensor hardware channels are only briefly reviewed. The advantage of 
analytical redundancy is that it avoids many of the size, weight, and cost 
penalties imposed by redundant hardware. The general disadvantage is computa- 
tional complexity. 

4. 3. 2.1 Bank of Kalman Filters 

This technique employs a group ('bank') of Kalman filters to hypothesize each 
failure mode. Normal operation of the system is represented by the null hypo- 
thesis Hq. The failure hypotheses are labelled as H^. The residuals of 
each filter are monitored and likelihood functions (e.g., probability density 
functions) are generated. Other statistical tests (7) can also be performed on 
the filter innovations. The hypothesis with the maximum likelihood of occur- 
rence is then selected as representing the true failure mode. Concepts under- 
lying the bank of filter's approach are discussed in references 8 and 9. 
Figure 35 demonstrates the concept. 
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BANK OF KALMAN 
FILTERS 


BANK OF LIKELIHOOD FUNCTIONS 


I 1 



I I 

FAILURE DETECTION LOGIC 


Figure 35 Bank of Kalman Filters Approach 


The advantages of the bank of filters technique are; 1) It provides a good 
yardstick for comparison with simpler techniques, and 2) It allows insight 
into the failure propagation dynamics after failure detection. The disadvan- 
tages are 1) the bank of filters approach results in excessive computational 
complexity, and 2) there is the possibility of the bank of filters becoming 
oblivious and failure^ going undetected. ^ — 

4. 3. 2. 2 Failure Sensitive Filters 

Failure sensitive filters can be classified as 1) filters using failure states 
in dynamics, and 2) detection filters. Figure 36 is a general block diagram of 
this technique. 

4. 3. 2. 2.1 Failure State Augmented Filters 

This type of filter augments the state vector with failure states to form a 
higher dimensional system in state space. Several techniques which use these 
filters and are sensitive to specific types of failures have been developed. 
Kerr (10) discusses an approach where a bounded region is defined around the 
nominal and estimated trajectories and tests are performed to determine over- 
lapping of the two regions. It is a geometrical approach and models failures 
as states for detection purposes. Figure 37 demonstrates this concept. 
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Figure 36 Failure Sensitive Filter Approach Overview 
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A simple approach for detection and isolation is to compare the estimated 
failure modes against a predetermined threshold. An advantage is that 
accommodation can be performed by using the estimate of the failure mode 
itself. A disadvantage is the poor estimation due to increased order of the 
fil ter. 

4. 3. 2. 2. 2 Detection Filters 

Detection filters were developed by Beard (11) and Jones (12). The basic idea 
is to select the gain matrix such that filter innovations tend to zero in the 
no- failure state and give an indication of sensor failure in the failed state. 
Beard's (11) choice of gains is directed towards making the innovations point 
in a fixed direction in case of a failure. For example, it is easy to show 
that if the first sensor fails, the first component of filter residual vector 
is large relative to other components. In such cases, faults may be detected 
and some faults isolated uniquely. 

The major advantage of detection filters is the simplicity with which they can 
be used. The disadvantages are 1) susceptibility to instrument errors and 
random disturbances, 2) applicable in theory only to linear regimes where the 
model structure does not change, 3) modelling errors may appear as soft fail- 
ures, 4) criteria for declaring faults are hard to set, and 5) in general, 
this method requires measurements of all state variables. 

4. 3. 2. 2. 3 Non-Obl ivious Filters 

If the mathematical model of a system is "close to" the actual physical 
system, Kalman filtering is the optimal technique for estimation. Performance 
may be degraded, however, due to modeling errors and the tendency of Kalman 
Filters to become "oblivious" to the sensor outputs. That is, as more and more 
information is received, the state estimation error covariance is decreased. 
Consequently, the filter gains are reduced and the filter bandwidth is reduced. 

If a failure occurs early in the measurement sequence, while the filter gain 
and bandwidth are large, the filter can respond properly to the change. How- 
ever, as the error covariance and gain decrease, the filter begins to "know 
the state too well." Thus, as time goes on, it becomes oblivious to incoming 
information and fails to track the actual system behavior. In fault tolerant 
systems it is desired to have filters which are sensitive to new data so that 
abrupt changes are reflected in the filter behavior. 

Two techniques exist for avoiding the oblivious filter. They are the exponen- 
tially age weighted filtering and the limited memory filtering (13). Both 
techniques ensure that the filter gains on all failure modes never approach 
zero. Hence, the filters remain sensitive to failures. 
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4. 3. 2. 3 Observers 


A traditional scheme for protecting a system against failures in its feedback 
sensors is to provide the system with three (or more) sets of sensors, so that 
there is redundancy in the feedback information. A voting logic may then be 
used to identify a faulty instrument output. This approach works well in 
systems where redundant instrument sets do not cause cost, weight, or size 
problems. 

The technique of using observers requires only one set of instruments. The 
redundancy provided by multiple sets of instruments is provided, artificially, 
in the control computer by a subsystem of multiple observers (Figure 38). It 
is assumed that the single set of instruments consists of three or more indi- 
vidual sensors. The output of each sensor is used to drive an observer, which 
is designed for that sensor. Thus, each sensor has its own observer. Each 
observer estimates the states, so there is redundancy in estimates. These 
observer estimates are compared in a voting manner. For perfect sensors and 
perfect system dynamics, the estimates will converge to the real state vector 
in a very short time. 


BANK OF 
OBSERVERS 



Figure 38 Bank of Observers Technique 


If a sensor fails, however, the observer estimate, corresponding to that 
sensor, is in error and a comparison between the estimated states identifies 
the faulty sensor. Reference 14 discusses a scheme using multiple observers. 
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4. 3. 2. 4 Voting Techniques 

When redundant sensor channel information is available (analytic or hardware 
redundancy) voting techniques are useful. These methods work very well for 
hard failures and certain types of soft failures. 

The standard voting process considers three (or more) "identical" signals. A 
marked deviation in one of the three redundant signals is sufficient to 
identify a failure. A recent voting scheme is presented in [15] by Broen. 

The advantages of this technique are 1) it is simple to use, 2) not much 
computation is involved compared to other techniques, 3) it is easy to 
implement. The disadvantages include 1) detection of hard failure is possible, 
but only for systems with a high level of parallel redundancy; and 2) soft 
failures, like bias shifts, are hard to detect. 

4. 3. 2. 5 Innovations-Based Failure Detection Schemes 

These schemes involve monitoring of the innovations of a filter based on the 
hypothesis of no-failure operation of the system. For a system described by a 
set of linear differential equations, a Kalman filter is often used to gener- 
ate this innovation process (or sequence)*. Several detection schemes are 
discussed here. 

4. 3. 2. 5.1 Generalized Likelihood Ratio Test 

The generalized likelihood ratio (GLR) technique requires existing functional 
redundancy to extract fault detection information. This technique monitors the 
output of one Kalman Filter (Figure 39). A bank of simple correlation opera- 
tions and threshold comparisons is driven by the filter innovations. These 
correlations are very complex, however, as found in current literature [16], 
[17]. 

The generalized likelihood ratio technique detects the onset of abrupt changes 
in linear systems. It allows simultaneous detection of failure, the time of 
occurrence of failure and the extent of the failure. The failure of a sensor 
produces a non-white residual 


y(k) = y' (k) + G^(k , 0) V 


( 9) 


* Mehra and Peschon (7) have discussed various innovations in testing for 
failure detection and isolation. 
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Figure 39 Innovations Based Detection and Isolation Scheme 


where 7'(k) is the residual for normal operating filter and Gj(k ,6) des- 
cribes the effect of failure v of type i occurring at a time 0 on a residual 
at time k. A set of hypotheses are established to distinguish between failure 
and no failure modes, as follows: 

Hq = no failure mode 

Hf == failure mode of type i ( v and 0 unknown) 

The Generalized Likelihood Ratio is defined as 

p(y(1), ....,Y(k))/H.^e = 0 (k), V = V (k) (10) 

" p(y( 1), Y(k)/Ho) 

where p is the probability density function of the innovations sequence [T(i) 
i = l,...k], given the hypothesis H-f and given the maximum likelihood esti- 
mates of 0 and V . 

When a failure occurs, the decision rule for choosing between a failure and no 
failure is 

for Hi true: Li (K)> Xq (11) 

for Ho true: Li (K)< Xq 

where Xd is a predetermined threshold. 

The advantages of this technique are: 1) built in functional relationships 
allow reduced requirements for multiple redundancy, 2) the technique is com- 
putationally feasible, 3) fast failure recovery is obtained since the time of 
failure occurrence is explicitly determined. The technique therefore does not 
have oblivious features. 
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The major disadvantage of this technique is that it is very sensitive to 
modelling errors. An accurate model is therefore required for a good estimate 
of failure parameters. 

4. 3. 2. 5. 2 Likelihood Ratio Test 


The likelihood ratio (LR) technique is in principle similar to the GLR tech- 
nique except that it does not involve prediction of failure time or the extent 
of failure. The likelihood ratio is simply a ratio of two probabilities 


p ( 7(1), . . . , 7(k))/Hi 
p ( 7(1 ) , . . . , 7(k) )/Hq 


( 12 ) 


where the probability density function in the numerator is calculated using 
the innovations 7(j) from a filter designed on the basis of assumed failure 
(hypothesis Hi) and the denominator is calculated based on the assumption of 
no-failure (hypothesis Hq). The likelihood ratio is compared against a 

predefined threshold Xq. If L-f(k) is less than X p, a decision is made 

in favor of no failure hypothesis Hq*. and if Li(k) is greater than x d» 
Hi is declared to be true, i.e., a failure is detected. 

4. 3. 2. 5. 3 Sequential Probability Ratio Test 

The sequential probability ratio test (SPRT) differs from the likelihood ratio 
test (LR) in that SPRT compares the likelihood ratio Li(k) (equation 12) 
against two thresholds X l, x y. If the ratio exceeds one threshold or 

falls below the other, a decision is made corresponding to the threshold that 
was crossed (see figure 40). The decision is, however, deferred until a 

threshold is crossed. 

This technique was not applicable because a valid state estimate is required 
at each time step for the control logic. Therefore a decision on whether or 
not a failure has occurred has to be made. This reduces the SPRT to a simple 
hypothesis test. 

4. 3. 2. 5. 4 Chi-Squared Test 

The chi-squared test is a test on the whiteness of a residual sequence. Speci- 
fically, the covariance C of an innovation sequence 7^, is given by (7) 

C = 1 2 (7i - 7 )•( Ti- - 7 )^ (13) 

N j=l 


where N 


size. In case of no failure, 

tion. The^trace^of C. has.,a chi-squared .( x 2) distribution ( 
degrees of freedom. A failure decision is made wnen the proba 

innovation sequences being non-white exceeds a specified threshold. 


i s the sampl e 
C. 


C has a WISHART distribu- 

IMl 
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Figure 40 Sequential Probability Ratio Test 

4. 3. 2. 5. 5 Modified Least Squares Criterion 

This technique was devised to suppress extremely large residuals, obtained 
from bad sensor data, by modifying the least squares criterion. A very small 
weighting is given to large residuals. This method essentially involves 
performing a static test at each point in time, incorporating the new meas- 
urement and the predicted estimate of this measurement based on previous data. 
This criterion is also referred to as Weighted Sum Square Residual (WSSR) test 
[ 8 ]. 

4. 3. 2. 5. 6 Modified Kalman Filter Design 

This procedure uses the functional redundancy in the system together with a 
modified Kalman filter as a means of fault detection. Several methods have 
been developed which modify the design of the kalman filter to achieve 
specific requirements. For example, a nonlinear single-stage filter algorithm 
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with filter gains calculated using a linearized system model is discussed in 
reference 25. This approach reduces the computational burden of a bank of 
Kalman filters running in parallel. A second example is the application of 
nonlinear filtering to failure detection in linear systems. This is discussed 
in reference 26. This approach derives linear optimal estimator equations 
using nonlinear filtering equations. Several other techniques are discussed in 
references 27 and 28. These techniques control the estimate error divergence 
in the case of a failure. 

4. 3. 2. 5. 7 Parameter Estimation Technique 

The failure modes (such as scale factor, failure parameters, and bias) are 
estimated from input and output data. These estimated values are compared with 
known values, and substantial differences between the two indicates a failure. 
Parameter estimation techniques are discussed in reference 18. 

A simplified block diagram of the above concept is shown in Figure 41. 



Figure 41 Parameter Estimation Technique 
4. 3. 2. 5. 8 Jump Process Technique 

This technique considers failures as jump processes with known probability 
distribution (19). It allows the formulation of failure sensitive control laws 
and computation of conditional probabilities of failure. 

Another technique (20) based on nonlinear filtering theory reparameterizes the 
Kalman filter for both tracking the state and detecting a fault. It is, how- 
ever, limited to specific types of failures. 

This approach is still in early stages of theoretical development. The general 
concept is to represent randomly occurring failures as jump processes and to 
estimate time of occurrence and magnitude of jumps using optimal filtering 
theory. Solutions turn out to be infinite dimension filters. Research is being 
carried out to circumvent this problem without losing too much performance. 
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4. 3. 2. 9 Accommodation of Failures 


Two failure accommodation techniques were utilized for development of advanced 
detection, isolation, and accommodation concepts. 

4. 3. 2. 9.1 Accommodation Using Failure Parameter Estimate 

Some of the detection and isolation techniques discussed above include the 
failure parameter (bias, drift) in the state vector for estimation purposes. 
Other techniques like maximum likelihood estimation (MLE) can also be used to 
estimate failure magnitude. The available failure parameter estimate can be 
subtracted from the measurement to produce an "unfailed" sensor reading. This 
technique requires a good estimate of the failure parameter. Once the failure 
is detected, accommodation could be delayed as much as the time involved in 
parameter estimation process. 

4. 3. 2. 9. 2 Reconfiguration and Reinitialization of the Kalman Filter 

If the Kalman Filter is being driven by faulty measurements, the state esti- 
mates wander off from their nominal values. Once a failure has been detected 
and isolated, the filter can be reconfigured so that the faulty measurement 
does not drive it. The reconfiguration involves using a new filter gain matrix 
designed with the assumption of one faulty measurement. This technique 
therefore requires as many gain matrices as there are failure modes. 

Once the filter is reconfigured, it should be reinitialized since the state 
estimates are off-nominal. Estimates from a robust filter are needed for 
reinitialization. If, however, robust estimates are not available, reconfigur- 
ation is adequate and will bring the filter back to its nominal path. A small 
transient will result if the filter is only reconfigured since the filter 
starts out at some off-nominal point as its initial condition. Reinitializa- 
tion will eliminate the transient. 

4.3.3 Formulation of Advanced Sensor Failure Detection, Isolation and Accom- 
modation Concepts 

Five viable advanced concepts were developed based upon the techniques dis- 
cussed in the last section. The available techniques were classified according 
to their functional features. Most techniques provide at least the detection 
capability with isolation and accommodation either implicitly (e.g., in a 
triplex voting scheme) or explicitly (e.g., in a bank of Kalman filters) 
addressed. A classification of the techniques based on the information 
processing structure, parameter on which tests are performed and decision 
techniques and logic used is presented in Table XII. 
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TABLE XII 


CLASSIFICATION OF DETECTION, ISOLATION AND ACCOMMODATION TECHNIQUES 
0 Logic Structure 

- On-line detection and isolation: detection and isolation are performed 
at each time step simultaneously 

- Off-line isolation: detection is always on-line but isolation is per- 
formed off-line, i.e., only after a failure is detected is isolation 
performed. 

0 Parameters 


- Innovations based failure check 

- Failure state parameter 

- Statistical probability check 

0 Decision Logic 

- Generalized Likelihood Ratio Testing (GLR) 

- Likelihood Ratio Testing (LR) 

- Sequential Probability Ratio Testing (SPRT) 

- Weighted Sum Square Residual (WSSR) 

- Voting 

0 Decision Technique 


- Bank of Observers 

- Bank of Filters 

- Failure sensitive Filters 


0 Accommodation Technique 

- Subtract estimated failure mode parameter (bias, drift) from the sensor 
measurement 

- Reconfigure (modify Kalman filter gains) and reinitialize (initialize 
to the filter corresponding to the isolated failure mode) the normal 
mode (no failure) filter. 


The goal in selecting five candidate concepts was to span as many applicable 
techniques as possible. Thus, selected features of the above techniques have 
been blended together to formulate the five candidate concepts for evaluation. 
These concepts are: 

1: Detection - Hypothesis testing using LR test 

Isolation - Off-line isolation using bank of Kalman filters 

based on GLR technique 

Accommodation - By "calculation" i.e., failure states are subtracted 

from the measurements. 
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2: Detection 


Isolation 


Accommodation 


Innovations testing based on USSR technique for soft 
failure 

Innovations testing against thresholds for hard 
failure 

On-line isolation of hard failures using innovations 
testing; off-line isolation of soft failure using 
GLR technique. Both structures employ bank of Kalman 
filters. 

Reconfiguration and reinitialization of normal mode 
filter. 


3: Detection 

Isolation 
Accommodation 


Hypothesis testing using LR technique 
Off-line logic using failure-sensitive filter 
By "calculation" i.e., failure states are subtracted 
from the measurements. 


4: Detection 

& Isolation - Simultaneous detection and isolation using failure 

sensitive filter (on-line) 

Accommodation - By "calculation" i.e., failure states are subtracted 

from the measurements. 


5: Detection 

& Isolation - Simultaneous detection and isolation using bank of 

observers and voting technique 

Accommodation - Computation of median of estimates from observers 

corresponding to unfailed measurements. 


Figures 42 through 46 are block diagrams of the five concepts. Techniques and 
logic employed by each concept are found in Table XIII. 


TABLE XIII 

SELECTED FAILURE DETECTION, ISaATION 
AND ACCOMODATION (FDIA) CONCEPTS 
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Figure 42 Detection, Isolation, and Accommodation Concept 1 



(ESTIMATE) 


Figure 43 Detection, Isolation, and Accommodation Concept 2 
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Figure 44 Detection, Isolation, and Accommodation Concept 3 



DETECTION. ISOLATION AND 



ACCOMMODATION PERFORMED 



USING FAILURE SENSITIVE 


z 

FILTER 

z 


(MEASUREMENT) 


(ESTIMATE) 


Figure 45 Detection, Isolation, and Accommodation Concept 4 



DETECTION AND ISOLATION PERFORMED USING 
BANK OF ONE INPUT ESTIMATORS AND VOTING 
TECHNIQUE 
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Figure 46 Detection, Isolation, and Accommodation Concept 5 

4. 3. 3.1 Discussion of Detection, Isolation and Accommodation Concepts 

The five concepts developed for preliminary evaluation are discussed in this 
section. A general formulation of the failure detection, isolation and accom- 
modation problem is presented below and will be used to explain detection, 
isolation and accommodation concepts. 
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A linear dynamic system can be modelled as follows: 

Plant Dynamics: X(t) = F(t)*X(t) + G(t)*U(t) + W(t) (14) 

Sensors: Z(t) = H(t)-X(t) + D(t)-U(t) + V(t) (15) 

Actuators: U(t) = g‘(Uc(t)) (16) 

equations (14) through (16) can also be written in discrete form for linear 
stochastic systems as: 

Plant Dynamics: X(k+1) = 0(k)*X(k) +r(k)*U(k) + W(k) (17) 

Sensors: Z(k) = H(k)-X(k) + D(k)*U(k) + V(k) (18) 

Actuators: U(k) = g'*(Uc (k)) (19) 

where W(k) and V(k) are zero-mean, independent, white Gaussian sequences with 
covariances given by: 

E [W(j)*wT (k)] = Q-5jk (20) 

E [V(j)-VT (k)] = R.5jk (21) 

and where a jk is the Kronecker delta. Equations (17) through (21) describe a 
"no failure*^ model of the system. The optimal state estimator for this model 
is a discrete Kalman filter: 

X(k + l/k) = 0(k)-X(k/k) + r(k)-U(k) (22) 

X(k/k-l) = X(k/k-l) + K(k)-Y(k) (23) 

7(k) = Z(k) - H(k)-X(k/k-l) - D(k)-^ _.J_24) 

Here 7(k) is the zero-mean, Gaussian innovations process. The estimator gain 
matrix, K, is found from: 

P(k+l/k) = 0(k)-P(k/k)-0T(k) + B(k)-QB'^(k) (25) 

P(k/k)= P(k/k-l)-P(k/k-l) HT(k)- [H(k)-P(k/k-l )-HT(k)+Rr''H(k)* P(k/k-l ) (26) 

K(k) = P(k/k-l)-H''’(k)- [V(k)]"'' (27) 

V(k) = H(k)-P(k/k-l)-HT(k) + R (28) 

where P(k) is the estimation error covariance of the estimate, X(k). 

The above general formulation is the basis of the concepts described in the 
following section. 
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4. 3. 3. 1.1 Detection, Isolation and Accommodation Concept 1 


De tection : This concept employs hypothesis testing based on the likelihood 

ratio (LR) technique. For example, normal mode or no failure operation is 
termed null hypothesis. Ho. The failure modes are also hypothesized and are 
termed as failure hypothesis, H] . 

In a given system, each observation (measurement) has a hypothesis associated 
with it. The hypothesis cannot be observed directly. A probability transition 
mechanism separates the hypothesis from observations. Hypotheses are accepted 
on the basis of knowledge of a priori probabilities, some inherent conditional 
probabilities and access to observation space. Thus a failure is detected by 
choosing a hypothesis according to some decision logic. In the detection 
scheme used here the decision logic is the likelihood ratio test. 

Let z be the observation at a decision time and z-t be the predefined 
threshold. A decision is then made by testing the hypothesis as follows, 

z < zt Ho i s true 

z >zt Hi is true (29) 


In the binary decision of Ho and Hi, a possibility of errors exists which 
are termed as "false alarm" and "miss". A false alarm is the condition when 
Hi is false but is accepted to be true. Acceptance of Ho when it is false is 
called a miss. Let the probability density associated with the measurements 
under the hypotheses Ho and HI be P(z/Ho) and P(z/Hi ) respectively. The 
object of the detection logic is to accept one of the two density functions. 
Figure 47 illustrates the hypothesis testing technique. A variety of threshold 
selection procedures exists which are given in Table XIV. Each of the mini- 
mization procedures results in the comparison of the ratio of two probability 
density functions to a given parameter. The resultant likelihood ratio test is 
then given by: 

P(z/Hi) < A implies Hq true 

P(z/Hq) > a implies Hi true (30) 

In Concept 1, Kalman filter innovations were obtained to formulate the Hq 
hypothesis (assuming perfect modelling and random noise). Innovations from a 
"failure insensitive filter" were obtained to formulate hypothesis Hi. 
Probability density functions using innovations were calculated and the 
likelihood ratio test performed for failure detection. 
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Figure 47 Hypothesis Testing Technique 
TABLE XIV 

THRESHOLD SELECTION 

Minimize Miss Probability for a Fixed False-Alarm Rate 
Minimize Sum of Miss and False-Alarm Probabilities 
Minimize the Bayes Risk 

B = Coo'P(Ho.Ho) + CotP(Ho,H-|) + Cio*P(Hi , Hq) + Cn-PtH-i.H-] 
where: 

P(Hi.Hj) = Phj (Hi/Hj) 

H-j hypothesis associated with failure mode i 

Cij cost of accepting H^- when Hj is true 

PHj. a-priori probability that Hj is true 

P(Hj/Hj) probability of accepting H^- given Hj is true 

Isolation : Multiple hypothesis testing using the Generalized Likelihood Ratio 

test (GLR) was used for isolation of failures. This technique differs from the 
Likelihood Ratio (LR) technique in that the probability density functions 
associated with the hypotheses involved an estimated parameter. Maximum like- 
lihood techniques was used to estimate the parameter and calculate the condi- 
tional densities. A bank of Kalman filters is used in parallel to produce in- 
novations. Each filter is based on an assumed failure mode (hypothesis). The 
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maximum likelihood estimate of the failure parameter and the filter innova- 
tions are used to calculate the generalized likelihood ratio and test the 
hypothesis: 


max P ^ 

0l(z/H], 0]) <Aimplies Hq true 


max P ^ 

0o(z/Hi , 0 q) >Ximplies H-] true (31) 


Accommodation : The filter which provides estimates to the control logic is 

the normal mode filter (Ho filter) and works directly with sensor measure- 
ments. In the event of a failure, the filter drifts while the failure is being 
isolated. After isolation the filter needs to be reinitialized. Isolation of a 
failure means acceptance of a hypothesis. The filter in the isolation scheme 
corresponds to the accepted hypothesis, and is used to reinitialize the normal 
mode filter. The filter must be reconfigured to avoid using the failed chan- 
nel. This is done by subtracting the failure estimate (maximum likelihood 
estimate) from the failed channel. The resulting reinitialized and recon- 
figured filter is the accommodation filter. 

A detailed flow chart of this concept is shown in Figure 48. 

4. 3. 3. 1.2 Detection, Isolation and Accommodation Concept 2 

Detection : The sensor failures can be classified as soft or hard failures. 

The detection scheme uses a simple threshold comparison check on the normal 
mode filter residuals to declare a hard failure. The Weighted Sum Square 
Residual (WSSR) test is used for soft failure detection. This technique, 
discussed in reference 8, uses filter innovations, for decision making. The 
innovation sequence 7(k) is white with known covariance if the model is 
perfect and there is no failure. In case of a failure the residual becomes 

7(k) = white noise + effect of failure 

and the detector is used to identify the failure using a priori knowledge of 
white noise covariance and the new statistics. To detect a failure, one 
therefore has to compute the quantity, (k) over the last N observations, 

l(k)=^ 7T(j)-V^j) -7(j) (32) 

j = k - N + 1 

where V(j) is given by (28). 
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Figure 48 Flow Chart of DIA Concept 1 
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Figure 48 Flow Chart of DIA Concept 1 (Continued) 
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Figure 48 Flow Chart of DIA Concept 1 (Concluded) 



The quantity l(k) is called the Weighted Sum Square Residual. For normal (no- 
failure) operation, l(k) is expected to remain small. However, in case of a 
failure, l(k) will increase. If X is the threshold value to make a decision 
between Hq and H] , we have 


Kk) 


<X implies Hq true 
>X implies H-| true 


(33) 


The size of N and X are design parameters, chosen to provide acceptable 
tradeoff between false alarms and misses. 

Isolation : In concept 2, isolation of soft failures is performed "off-line" 
using a likelihood ratio test. This procedure was discussed in the detection 
scheme of concept one. For isolation purposes, however, since M failure modes 
are hypothesized, M Kalman filters (bank of filters) are designed based on 
each failure mode. Each of the filters ignores one measurement and operates on 
the assumption that the channel containing the failure information has been 
ignored. When a failure occurs, the filter which ignores the failed channel 
stands out from all other filters and the likelihood ratio test is used to 
identify the failed channel filter. 

The design parameters involved in this isolation process are the thresholds 
used to perform the likelihood ratio test. The techniques in Table XIV can be 
used for this purpose. 

Accommodation : The normal mode filter serves as the accommodation filter for 
the no-failure case. In case of a hard failure, where the failure is detected 
and isolated simultaneously, the accommodation filter is reconfigured to 
eliminate the failed channel. One of the isolation filters which ignores the 
failed channel is used for this purpose. There may be small transients 
associated with switching filters. In case of soft . failures, the normal mode 
filter provides estimates to the control logic while the failure is being 
isolated. After the isolation of the failure the accommodation filter; i.e., 
the normal mode filter, is reinitialized and reconfigured using the "isolated" 
filter. 

Once a failure has been detected and isolated, further tests for additional 
failures are performed on the accommodation filter. Each time a failure is 
isolated, the accommodation filter is reinitialized and reconfigured. 

A detailed flow chart of this concept is shown in Figure 49. 

4. 3. 3. 1.3 Detection, Isolation and Accommodation Concept 3 

Detection: The likelihood ratio based detector, used in concept 1 is used for 
detection purposes. 
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Figure 49 Flow Chart of DIA Concept 2 
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Figure 49 Flow Chart of DIA Concept 2 (Continued) 
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Isolation ; A failure sensitive filter is used for off-line isolation of 
failures. This filter models the failure parameters (biases, drifts, scale 
factor changes) as states and estimates these parameters. The failure magni- 
tudes are compared to a threshold to isolate the failure. Note that the 
failure state is being used as a test parameter instead of filter innovations 
in previously discussed concepts. 

Accommodation : The estimated failure state, using the failure sensitive 
filter in the isolation scheme, is subtracted from the isolated channel and 
used as the input to the normal mode filter. Since the estimate is updated at 
each time step, the normal mode filter receives the most current failure 
estimate. Thus the normal mode filter is always working with correct informa- 
tion (assuming perfect model and estimate). The accommodation filter (normal 
mode filter) requires no reinitialization or reconfiguration. However, a 
transient may be associated with subtracting the failure state because the 
filter may have drifted off while the failure was being isolated. 

Figure 50 is a detailed flow chart of concept 3, where bias is shown as the 
assumed failure mode in the isolation scheme. 

4. 3. 3. 1.4 Detection, Isolation and Accommodation Concept 4 

Detection, Isolation and Accommodation : Several well known techniques exist 
to design failure-sensitive filters L6, 8, 9, 16, 17]. The filter used in this 
concept is the same as the failure-sensitive isolation filter of concept 3. 
This single filter provides the three functions of detection, isolation and 
accommodation. Detection and Isolation are performed on-line simultaneously by 
comparing the estimated failure state against a threshold. Accommodation is 
performed by subtracting the failure state from the channel determined to be 
failed. 

Figure 51 is a detailed flow chart of this concept. Bias is used as the 
assumed failure state to demonstrate the function of the DIA concept. 

4. 3. 3. 1.5 Detection, Isolation and Acconmodation Concept 5 

Detection and Isolation : A traditional scheme for failure protection of sys- 
tem is to provide redundant sensors and use voting logic to detect a failure. 
In the detection and isolation technique employed here, redundancy is provided 
by a bank of Luenberger observers [23]. The output from each sensor serves as 
input to an observer which estimates the state vector. The state estimates 
from each observer are voted on to detect and identify a faulty sensor. 

The essence of this DIA concept was derived from Reference [14]. A detailed 
flow chart is given in Figure 52. A problem arises if small errors are present 
in the design coefficients of different observers or if small noise exists in 
the sensors. This is corrected by setting a threshold for each sensor and 
declaring a failure if the failure magnitude exceeds that threshold. 

Accommodation ; The accommodation scheme calculates a median of the estimates 
from the unfailed channels to feed them to the control logic. 
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Figure 50 Flow Chart of DIA Concept 3 (Concluded) 
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Figure 51 Flow Chart of DIA Concept 4 




Figure 52 Flow Chart of DIA Concept 5 
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Figure 52 Flow Chart of DIA Concept 5 (Concluded) 

4.4 RESULTS OF PRELIMINARY SCREENING PROCESS 
4.4.1 Introduction 

Advanced detection, isolation and accommodation techniques were reviewed and 
five viable concepts were formulated as discussed in the previous section. 
These concepts were implemented on the simplified simulation of the FIDO 
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engine and multivariable control. Using the scoring system discussed previous- 
ly, a screening process evaluated performance of each concept for single PT6, 
PT4, N1 , N2, and FTIT sensor failures at the sea level static operating 
condition. Each concept was awarded points In terms of Its Detection perfor- 
mance and criteria. Results of this screening process are presented In this 
section. A schematic of the overall procedure Is shown on Figure 53. 

Two Concepts were selected for further evaluation as a result of this screen- 
ing process. This evaluation also utilized the simplified model operational 
over the sea-level static operating line. Evaluation was performed for 
multiple sensor failures, noise, modelling errors and logic complexity. 
Results of the evaluation are also presented In this section. 

Based on the detection. Isolation and accommodation performance of each 
concept, one concept was chosen for Implementation, validation and evaluation 
on the detailed nonlinear FIDO engine and multivariable control simulation. 

4.4.2 Sensor Model 

A sensor model was developed for Implementation on the engine simulation. This 
model simulates a wide variety of sensor failures. 

The failed sensor model used was 

Ysn = Ksf * Y + Kbi + a * V (34) 

where 

Ygjj Is the sensor output 
Kgp Is the scale factor 

Y Is the measured variable 
Kgj Is the bias 

A Is the noise amplification factor 

V Is the noise with normal distribution N (0,1); zero mean and unit 
variance 

Hard failures, soft failures, biases and drifts can be simulated with this 
model . 


4.4.3 Evaluation of Five Concepts 

A comprehensive evaluation of the five detection. Isolation and accommodation 
concepts was performed to determine the relative merits of each concept. The 
evaluation scored each concept for detection performance, engine protection 
limit exceedances, and steady state and transient performance using the 
scoring system described In Appendix B. 
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Figure 53 DIA Concept Evaluation and Selection Procedure 
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The flight point altitude = 0 ft, Mach No. = 0, and PLA = 83 degrees (Sea 
Level Static - Intermediate power) was chosen for this preliminary evaluation. 
A sixteenth order linear model was available and was reduced to fourth order 
linear model using the techniques discussed in Section 4.2. This simplified 
model was used both as the engine dynamic model and for filter update 
equations required by the DIA concepts. 

Each concept was implemented as an independent software module which provided 
interchangeability and ease in modification. Each concept was evaluated and 
ranked based on its single failure capability. Table XV presents the results 
of the steady state performance of each concept when a soH failure (bias) of 
+50 RPM in fan speed measurement (Nl) was introduced. The last column in Table 
XV lists the total score; the higher the total score, the worse the perform- 
ance. The total score was calculated by summing the individual scores from the 
engine protection, steady state thrust variations, and time to detect portions 
of the scoring system. Note that for a case in which a concept was unable to 
isolate the failure properly, a maximum score of 15 was assigned to that 
concept. This steady state evaluation was of somewhat limited useful 1 ness due 
to the fact that the simplified engine model was used both in the filters and 
as the engine simulation; i.e., perfect modelling. Several scores of zero were 
due to this perfect modelling. This was most evident in the engine protection 
portion of the score. 


TABLE XV 

SCORING RESULTS (SOFT Nl FAILURE) 

FLIGHT CONDITION: ALT = 0, Mn = 0 PLA = 83 (STEADY STATE) 
FAILURE TYPE; Nl BIAS (+50 RPM) 
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CON- 
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0.002 

0.002 

★ ★ 
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■ 

■ 



.006 

4.0 

15 

2 

0.002 

0.002 

0.016 







0.0 


HI 

3 

0.002 

0.002 

0.514 







0.1 

10.0 

10.1 

4 

0.002 

0.516 

0.516 







0.01 

10.0 

10.0 

5 

0.002 

0.02 

0.02 







.0001 

0.0 

**+ 

e 


♦Steady State Thrust 

♦♦Since failure was not isolated, the maximum score of 15 was assigned to that 
concept 

**♦ e represents a very small non zero value 
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A hard failure (bias) of +300 RPM in fan speed measurement was induced and the 
steady state and transient performance of each concept was scored. A Power 
Lever Angle (PLA) step change from 35 degrees to 83 degrees was input at t=0 
seconds and the failure induced at t=0.002 seconds to obtain the transient 
plots of Figures 54 through 58. The results of the scoring system are pre- 
sented in Table XVI and XVII for steady state and transient performances, 
respectively. 



Figure 54 Concept 1; N1 Time History Resulting from a 35 to 83 PLA snap at 

t=0. Seconds With a Hard N1 failure (+300 RPM) at t = 0.002 Seconds. 



Figure 55 Concept 2; N1 Time History Resulting from a 35 to 83 PLA snap at 

t=0. Seconds With a Hard N1 failure (+300 RPM) at t = 0.002 Seconds. 
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Figure 56 Concept 3; N1 Time History Resulting from a 35 to 83 PLA snap at 

t=0. Seconds With a Hard N1 failure (+300 RPM) at t = 0.002 Seconds 
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Figure 57 Concept 4; N1 Time History Resulting from a 35 to 83 PLA snap at 

t=0. Seconds With a Hard N1 failure (+300 RPM) at t = 0.002 Seconds 
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Figure 59 Concept 1; N1 Time History Resulting from a 35 to 83 PLA snap at 
t=0. Seconds With a Hard PT4 failure (+10 PSIA) at t = 0.002 
Seconds. 
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igure 60 Concept 2; N1 Time History Resulting from a 35 to 83 PLA snap at 
t=0. Seconds With a Hard PT4 failure (+10 PSIA) at t = 0.002 
Seconds. 



Figure 61 Concept 3; N1 Time History Resulting from a 35 to 83 PLA snap at 
t-0. Seconds With a Hard PT4 failure (+10 PSIA) at t = 0.002 
Seconds. 
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Figure 62 Concept 4; N1 Time History Resulting from a 35 to 83 PLA snap at 
t=0. Seconds With a Hard PT4 failure (+10 PSIA) at t = 0.002 
Seconds. 
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Figure 63 Concept 5; N1 Time History Resulting from a 35 to 83 PLA snap at 
t=0. Seconds With a Hard PT4 failure (+10 PSIA) at t = 0.002 
Seconds. 








TABLE XVI 


SCORING RESULTS (HARD N1 FAILURE) 

FLIGHT CONDITION: ALT = 0, Mn = 0 PLA = 83 (STEADY STATE) 
FAILURE TYPE: N1 BIAS (+300 RPM) 
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TABLE XVII 

SCORING RESULTS (HARD N1 FAILURE) 

FLIGHT CONDITION: ALT = 0, Mn = 0 PLA = 35 TO 83 DEGREES (TRANSIENT) 

FAILURE TYPE: N1 BIAS (+300 RPM) 
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A hard failure bias of +10 PSIA in burner pressure measurement (PT4) was 
introduced at t = 0.002 seconds and detection, isolation and accommodation 
performance evaluated for a PLA transient from 35 degrees to 83 degrees t=0.0 
seconds. Figures 59 through 63 are time history plots of fan speed and Table 
XVIII presents the scoring results. 

TABLE XVIII 

SCORING RESULTS (HARD PT4 FAILURE) 

FLIGHT CONDITION: ALT = 0, Mn = 0 PLA = 35 TO 83 DEGREES (TRANSIENT) 

FAILURE TYPE: PT4 BIAS (+10 PSIA) 



SCORING 

CON- 

TIME 

TIME 

TIME 

El 

^GINE 

PROTI 

ECTION 

TRAN- 

TIME 

Wm 

CEPT 

INDUCED 

DETECTED 

ISOLATED 

yyjy 


igyi 

im 


|gl2 

SI ENT 

DETECT 

B 

1 

0.002 

0.002 

★ ★ 

■ 

0.05 

■ 




0.5 

4.0 

15.0 

2 

0.002 

0.002 

0.002 

■ 

0.02 


■ 

■n 


0.002 

0.0 

0.02 

3 

0.002 

0.002 

0.008 

■ 

0.01 

■ 

■ 


m 

0.01 

0.0“^ 

0.02 

4 

0.002 

0.07 

0.07 

H 

0.6 


■ 


0.1 

0.8 

0.0 

1 .5 

5 

0.002 

0.012 

0.012 


*** 

€ 


★★★ 

€ 

★★★ 

e 




0.0"^ 


Based on the scoring results the following order was established for 
performance of each concept: 

0 FIRST - CONCEPTS 2 and 5 

0 THIRD - CONCEPT 3 

0 FOURTH - CONCEPT 4 

0 FIFTH - CONCEPT 1 

Thus concept 2 and 5 were chosen for further study. Details are presented in 
the following section. 

4.4.4 Further Evaluation of Two Concepts 

The operating region for evaluating the two selected concepts was extended for 
operation over the sea level static (altitude = 0 ft., Mach. No. = 0) opera- 
ting line. The sixteenth order linear models were available for power points, 
PLA = 20, 36, 52, 67 and 83 degrees. These models were reduced to fourth order 
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models and parameterized over the sea level operating line to develop a 
simplified, reduced-order, nonlinear model. The same model was used for engine 
dynamics as well as filter update equations. Evaluation of concepts 2 and 5 
was performed based on their single and multiple failure performance, effect 
of noise, and logic complexity. The relative advantages and disadvantages of 
each concept are summarized in Tables XIX and XX. 


TABLE XIX 
CONCEPT #2 SUMMARY 

ADVANTAGES DECISION FILTERS BASED ON MAXIMUM INFORMATION 

DECISIONS BASED ON STATISTICAL SIGNIFICANCE OF OUTPUT 

DISADVANTAGES STATISTICALLY SIGNIFICANT TESTS MORE DIFFICULT TO 

IMPLEMENT THAN SIMPLE THRESHOLD COMPARISON 

- DEPENDENT ON NOISE ASSUMPTIONS 

- DEPENDENT ON MODEL ACCURACY 


TABLE XX 

CONCEPT #5 SUMMARY 

ADVANTAGES DECISION TESTING IS SIMPLE 

DECISIONS BASED ON HIGHLY FILTERED SIGNALS 
LOGIC IS SIMPLE 

DISADVANTAGES DECISION FILTERS BASED ON MINIMUM INFORMATION 


A soft N1 failure (bias) of +50 RPM and soft PT4 failure (bias) of + 3 PSIA 
were introduced at t = 0.1 and 0.2 seconds, respectively. A separate random 
noise signal was generated and superimposed on all five measurements with the 
same magnitude of noise amplification factor, A=1 (see equation 34). A step 
input from PLA = 30 to 83 degrees was commanded at t = 0.002 seconds. The 
transient response of N1 and PT4 are given in Figures 64 and 65 for concept 2 
and in Figures 66 and 67 for concept 5. The solid line is the engine simula- 
tion output, the large broken line is the output of accommodation filter and 
the small broken line is the unfailed sensor measurement (including sensor 
lag). The failure detect and isolate events are registered along with the 
channel and the time on each plot. 
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Figure 64 


Concept 2; Nl Transient Response With Nl and PT4 Sensor Failures 
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Figure 66 Concept 5; N1 Transient Response With N1 and PT4 Sensor Failures 
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Figure 67 Concept 5; N1 Transient Response With N1 and PT4 Sensor Failures 
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Figures 68 through 73 are timing diagrams associated with other combinations 
of sensor failures. They register detect and isolate events and times. Concept 
5 detected and isolated all failures correctly. However, it also falsely de- 
tected, and isolated fan turbine inlet temperature sensor failures when fail- 
ures of other sensors were induced. This was attributed to the poor perform- 
ance of the observer designed with FTIT as its only input. Since the time 
constant associated with fan turbine inlet temperature channel is slow, the 
estimates do not follow the measurement very well, causing the false failure 
detection. Concept 2 does very well in correctly detecting and isolating 
failures but also declared false alarms. This, in most cases, happened after 
two failures were detected and isolated and can be attributed to the perform- 
ance of the accommodation filter after two failure accommodations. In figures 
64, 65, 70 and 72 the false alarm was generated at the next time step after 
the isolation of a failure. In the detection technique, the weighted sum 
squared residual is averaged over last five measurements and then compared 
against the threshold for failure detection. After isolation of the failure 
the memory (past five measurements) should be erased (zeroed out) for a fresh 
start. It was not done so in the Concept 2 implementation. Therefore the 
residual remains high and allows generation of a false alarm right after fail- 
ure isolation. This was observed every time a soft failure was isolated 
because USSR technique is only used for soft failure detection. A summary of 
the detection, isolation and accommodation performance of the two concepts in 
given in Table XXI. 
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Figure 69 Concept 5 Detection and Isolation Timing Diagram, N1 and N2 Sensor 
Failures 
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Figure 71 Concept 5 Detection and Isolation Timing Diagram, PT4 and PT6 
Sensor Failures 
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Figure 72 Concept 2 Detection and Isolation Timing Diagram, N2 and PT6 Sensor 
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TABLE XXI 

' SUMMARY OF EVALUATION OF TWO CONCEPTS 

CONCEPT 2 PERFORMANCE HIGHLY DEPENDENT ON THRESHOLD PARAMETERS 

NO MISSED FAILURES FOR ERRORS 2a* 

CONCEPT 5 ABLE TO ISOLATE FAILURES WITH ERRORS = 1 a * 

LOGIC SIMPLE TO IMPLEMENT 
SLOW FTIT OBSERVER 

The two concepts look very promising. The logic complexity of concept 5 is 
relatively simpler than concept 2. Concept 2 treats hard and soft failures 

separately. Hard failure detection, isolation and accommodation logic of con- 

cept 2 involves less computation than concept 5. Soft failure logic of concept 
2 is more complex than concept 5. Overall comparison reveals that the hard 

failure DIA performance of both concepts was very good. The soft failure DIA 
performance of Concept 2 was superior to concept 5. In the light of the above 
and Tables XIX to XXI, concept 2 was chosen as the final candidate concept for 
evaluation on the detailed nonlinear simulation of the FIDO engine. 

4.4.5 Final Concept Evaluation 

The final concept selected was incorporated into the detailed nonlinear FIDO 
engine and multivariable control simulation for detailed evaluation. A simpli- 
fied nonlinear model was developed by reducing the available sixteenth order 
linear models to the fourth order linear models. The fourth order models span 
the entire flight envelope and were parameterized for operation over the 
flight envelope. This simplified nonlinear model was used to update filter 

equations of Concept 2. Note here that since the engine dynamic model and fil- 
ter model were different, modelling errors were taken into account by increas- 
ing the detection and isolation thresholds. 

* 0 = Standard Deviation 
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5.0 COMPARISON OF PARAMETER SYNTHESIS AND ADVANCED ALGORITHMS FOR SENSOR 
FAILURE DETECTION, ISOLATION AND ACCOMODATION 


5.1 INTRODUCTION 

A detailed evaluation of the parameter synthesis based detection, isolation, 
and accommodation algorithm and advanced algorithm was conducted by simulating 
sensor failures for both steady state and transient operation at the 15 flight 
operating points, using the nonlinear FI 00 engine and Multivariable Control 
(MVC) simulation. The evaluation results of the two algorithms were compared 
to determine the benefits of implementing advanced algorithms in production 
control systems, rather than the conventional parameter synthesis techniques 
currently used. The following paragraphs present the results of the comparison. 

5.1.1 Steady State Comparison 

Steady State failure effects were evaluated for the two algorithms at the 
fifteen flight operating conditions selected for this program. The failures 
were induced by applying a constant bias to the sensor to be failed. The 
magnitude of the biases applied to the sensor values were: 


N1 

2000 RPM 

N2 

2000 RPM 

PT6 

35 psi 

PT4 

50 psi 


Since the purpose of this test was to observe the accommodation accuracy of 
the algorithms, the biases were set arbitrarily large to insure failure detec- 
tion. When the failure was induced, the resulting failure transients were 
observed and, after the transient effects decayed, pertinent steady state 
results were recorded. Tabulations of the resulting Steady State data for the 
PT6, PT4, N1 , and N2 sensors failures are shown in Tables XXII through XXVI. 
These tabulations show the errors in PT4, N2, N2, fan turbine inlet tempera- 
ture, thrust, and surge margins caused by using analytically generated inputs 
after any failure accommodation has taken place. The errors on the input 
signals (estimation errors) are calculated by taking the difference between 
the actual parameter value and the value being sent to the control laws. 
Variation in thrust is calculated as a function of the thrust that the engine 
is generating after the failure accommodation relative to the normal steady 
state thrust levels with perfect sensor feedback. 

5.1.2 Comparisons With No Failures Induced 

Table XXII shows the Steady State estimation errors and resulting thrust 
variations for the fifteen flight operating conditions with no failures 
induced. Since the parameter synthesis technique reverts to the synthesized 
signal only in the presence of a failure, the no- failure case results in no 
estimation errors. The advanced detection, isolation and accommodation concept 
feeds back the Kalman filter estimates to the control law. Therefore, estima- 
tion errors on the sensor inputs are present. The magnitude of estimation 
errors is a function of the accuracy of the model within the algorithm. 
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From Table XXII, it is seen that the estimation errors for the advanced algo- 
rithm vary as a function of flight condition. As noted in Section 4.1.3, 
increasing the linear data available for generating the model at the higher 
error flight conditions and improving modeling techniques could significantly 
reduce these estimation errors. This Table also shows that the fan turbine 
inlet temperature estimator is the driving force for the large estimation 
errors at many flight conditions. Therefore, additional work would be required 
on that portion of the estimator prior to implementing it in control system 
hardware. Since the fan turbine inlet temperature estimator was shown to be 
very inaccurate, it was not considered in the steady state comparison. 

5.1.3 Comparisons With a PT6 Sensor Failure Induced 

Steady State comparisons for the two detection, isolation and accommodation 
algorithms' accommodation of a PT6 sensor failure are shown on Table XXIII. 
This Table shows very good steady state PT6 failure accommodation for both the 
parameter synthesis and the advanced algorithm. The PT6 accommodation error 
for the parameter synthesis technique results in a maximum variation in thrust 
of 1.7% with very little variation in fan or compressor surge margins. The 
advanced algorithm shows estimation errors up to 50% thrust variation at the 
high altitude, high Mach number conditions. However, these errors are 
comprised of two portions: 1) the basic estimation errors with no sensor 
failures which were previously shown in Table XXII to be a function of 
modeling errors; and 2) the accommodation errors resulting from zeroing a 
column of the 'K' matrix in the Kalman filter. 

To put the accommodation errors in perspective, one must examine the error 
shown on the sensor failure tables relative to the no-failure case. For 
example, for the sea level static, 83° PLA flight operating point, the total 
thrust variation when accommodating a PT6 failure with the advanced algorithm 
relative to the perfect sensor feedback case is shown to be -2.5%. On Table 
XXI, the no failure case was shown to result in a thrust variation of -3% 
relative to the perfect sensor feedback case. Thus accommodation of a PT6 
failure actually reduced the total thrust variation from -3% to -2.5%. 

Table XXIV shows a summary of the advanced detection, isolation and accommoda- 
tion algorithm's estimation errors at sea level static, 83° PLA. The total 
estimation error is the sum of the basic estimator error with no sensor 
failures and the accommodation error which results from zeroing a column of 
the "K" matrix in the Kalman filter. This table shows little or no variation 
in the estimation error between the no failure case and the sensor failure 
cases. This illustrates that the algorithm's accommodation error is very small. 

5.1.4 Comparisons With an N1 Sensor Failure Induced 

Steady state comparison of the two algorithms accommodation for an N1 sensor 
failure is shown in Table XXV. This Table shows good steady state N1 failure 
accommodation for both the parameter synthesis and the advanced algorithm at 
most flight operating points. The parameter synthesis algorithm's worst 
negative thrust variations occur at low power conditions and the worst 
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PARA«TER SYNTHESIS/DIA CONCEPT STEADY STATE COMPARISONS - PT6 FAILED +30 PSI 
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PARAMETER SYNTHESIS/OIA CONCEPT STEADY STATE COMPARISONS - N1 FAILED +2000 RPM 
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positive errors occur at high power, both of which, could be reduced with 
minor power lever adjustments by the pilot. The parameter synthesis algorithm 
did not respond well at 65k/2.5 due to a multivariable control stability prob- 
lem which resulted in exceeding the operating range of the N1 parameter 
synthesis curve. This could be rectified by extending the parameter synthesis 
curves, however, since the cause of the problem was a control stability prob- 
lem, it was not felt to be worthwhile. 

The advanced algorithm shows good accommodation to an N1 failure at most con- 
ditions where the fan turbine inlet temperature estimator is not the controll- 
ing loop (65k ft/1.2Mn, 65k ft/2.5Mn). At 10k ft/0.9Mn and 45k ft/0.9Mn, a 
control stability problem is experienced after the failure is accommodated. It 
is felt that this problem could be rectified by improving the Kalman filter 
gains. At the remaining conditions, the thrust variation is less than 6.5% 
with little variation in fan or compressor surge margin. 

5.1.5 Comparisons With an N2 Sensor Failure Induced 

A comparison of steady state accommodation of an N2 speed sensor failure for 
the two algorithms is shown in Table XXVI. Both algorithms accommodate an N2 
failure with little variation in thrust, fan surge margin, or compressor 
margin. The parameter synthesis algorithm limits thrust variation for an N2 
failure accommodation to 4.4% except at 65k ft/2.5Mn where the thrust varia- 
tion is larger but still limited to less than 10%. At 24k ft/1.8Mn, the para- 
meter synthesis algorithm does suffer a 5.4% loss in compressor surge margin, 
however, it still has adequate surge protection (9% compressor surge margin). 
The advanced detection, isolation and accommodation algorithm is shown to 
experience only minimal additional performance degradation when accommodating 
an N2 sensor failure. At 50k ft/.9Mn, the system was slightly unstable when 
accommodating an N2 sensor failure, however, the magnitude of the oscillation 
was minimal. 

5.1.6 Comparisons With an PT4 Sensor Failure Induced 

A comparison of the two algorithms' steady state accommodation to a PT4 sensor 
failure is shown in Table XXVII. This Table shows an acceptable amount of 
steady state thrust variation resulting from accommodation of the failure. At 
some conditions both algorithms experienced difficulty accurately detecting 
and isolating the PT4 failure. At four flight operating points (0 ft/OMn 83“ 
PLA; 0 ft/OMn 130* PLA; 0 ft/1.2Mn 83" PLA; 10k ft/0.9Mn 83" PLA) the para- 
meter synthesis algorithm detected a failure, but was unable to pinpoint the 
failure to the PT4 sensor. Referring to the parameter synthesis curve set 
shown in Figure 74, the four failure cases detected the failure by going out 
of tolerance on curve 2. Since curve 2 can be out of tolerance by itself for 
an N2 drift or a PT4 drift depending on the flight condition, it does not 
provide adequate information to isolate the sensor failure. To isolate a 
failure to PT4, curve 1 must also be out of tolerance with the sensed signal. 
Since the tolerance bands on curve 1 were sized to provide adequate margin for 
curve read errors at the higher altitude conditions, a large sensor drift is 
required at the lower altitude condition to drive the curve out of tolerance 
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PARAMETER SYNTHESIS/DIA CONCEPT STEADY STATE COMPARISONS - N2 FAILED +2000 RPM 
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65K/2.5 83* + 4.0 NA NA NA NA - 0 0 Simulation +6.6 + 1.8 - 10 +40 +122 +29.7*+ + .01 + .03 P6 4 FTIT 

Unstable False alani 

6SIC/2.5 130* 0 NA NA NA NA + 2* +.0008 +.001 +9.0 + 1.6 0 +120 +167 +44.5*+ + .01 +.027 P6 4 FTIT 

False Alarms 



CURVE 1 


CURVE IB 


PT4 SYNTHESIS 


N2 SYNTHESIS 


PT6 SYNTHESIS 


N1 SYNTHESIS 



N2C2 


N2C2 





N2C25 


FTIT 

SYNTHESIS 



Figure 74 Parameter Synthesis Curve Set 



with the sensor measurement. A biasing technique could be implemented (perhaps 
a PT2 bias) to reduce the tolerance band for curve 1 at the lower altitude 
conditions. However, since the non-isolated failure has only minimal effect on 
engine performance, the additional complexity of a biasing technique would be 
of questionable value. 

The advanced algorithm also had difficulties isolating the PT4 failure at some 
flight operating conditions. This problem could be reduced by improving the 
simplified model's accuracy and redesigning the failure isolation tolerance 
bands. 

1 

5.1.7 Comparisons With a Fan Turbine Inlet Temperature Sensor Failure Induced 

The two detection, isolation and accommodation algorithm's steady state accom- 
modation to a fan turbine inlet temperature sensor failure was evaluated at a 
few flight operating points. It became evident that neither system provided 
adequate . protection when operating on the synthesized or estimated value. 
These results are consistent with previous in-house studies which showed the 
accuracy of a synthesized signal to provide inadequate temperature limiting 
protection. With the advanced concept, however, improving the accuracy of the 
modeling approach within the algorithm may significantly improve the accuracy 
of the fan turbine inlet temperature estimate to insure adequate engine pro- 
tection. This should be evaluated in future studies. 

5.2 TYPICAL FAILURE TRANSIENTS 

When the steady state sensor failures were induced, the resulting perturbation 
on engine performance was observed. For most conditions, there was less fail- 
ure/accommodation transient with the advanced detection, isolation and accom- 
modation algorithm than with parameter synthesis. This was expected since the 
parameter synthesis technique requires a switching from a sensor measurement 
to a synthesized signal to accommodate a sensor failure, whereas the advanced 
algorithm is always feeding back estimator values. To accommodate a sensor 
failure, the advanced failure detection, isolation and accommodation algorithm 
reconfigures the normal mode filter to eliminate the failed sensor from the 
computation of the estimated values. 

Figure 75 compares the failure transients of pertinent engine performance 
parameter for a typical sensor failure. The time histories shown result from 
an N2 failure occurring at a time of 3.0 seconds at the sea level static, 83“ 
PLA flight operating point. The parameter synthesis case shows a failure 
transient of 255 pounds thrust variation compared to the advanced algorithm's 
60 pound thrust variation, however, after the failure transient decay, the 
parameter synthesis case shows 52 pounds of thrust less accommodation error. 

5.3 DETECTION/ISOLATION ACCURACY 


To compare the detection and isolation performance of the parameter synthesis 
and advanced algorithms, slow sensor drifts were simulated at the flight 
operating conditions shown to be the most sensitive to in-range failure in the 
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Figure 75 Failure Transient Comparisons for an N2 Sensor Failure at Sea Level 
Static Conditions and 83° PLA 


no 



Failure Mode and Effects Critical Analysis (FMECA). When the failure was 
detected and isolated, the magnitudes of the bias and thrust variation were 
recorded, as tabulated in Table XXVIII. N1 drifts were not included in this 
study since the analysis showed that in-range N1 failures rarely occurred. 

As shown in Table XXVIII, the advanced algorithm is less sensitive to PT6, 
PT4, and fan turbine inlet temperature drifts than the parameter synthesis 
based algorithm. The PT4 drift, for example, is detected and isolated as a 
failure for smaller magnitudes of drift with the parameter synthesis technique 
(32 psi compared to 44.3 psi with the advanced concept). However, the 
parameter synthesis based on algorithm experienced a -5.4% larger thrust 
degradation prior to accommodation than was experienced with the advanced 
algorithm. The reduced performance degradation with the advanced concept 
results from the Kalman filter gains being sized to place the highest 
weighting on the N2 speed signal and considerably less weighting on the PT4, 
PT6, FTIT, and N1 signals. Therefore, when the PT4 signal was drifted, the 
estimated sensor values changed only slightly for a large magnitude of drift. 
Conversely, when the N2 signal was drifted, the estimated sensor values 
followed the N2 sensor drift resulting in significant performance degradation 
(greater than 10% thrust change) and difficulties in failure detection and 
isolation. 


TABLE XXVIII 

Parameter Synthesis/Detection, Isolation and Accommodation 
Concept 2 Sensor Failure Detection Comparisons 


Flight 

Operating 

Point 

Sensor 

Drift 

Parameter Synthesis 
Bias be- FNT be- 
fore DIA fore DIA 

DIA Concept 2 
Bias be- FNT be- 

Comments fore DIA fore DIA Comments 

0/0 20“ 
PLA 

PT6 drifted 
Positive 

+12.7 PSI 

-3.5% 

+5.68 PSI 

+0.1% 

0/0 83“ 
PLA 

PT4 dri fted 
Positive 

+32 PSI 

-5.6% 

+44.3 PSI 

-0.2% 

0/1.2 
83 “PLA 

FTIT drifted 
Positive 

+78“F 

-20.3% 

+114“F 

0 

20k/0.3 
83 “PLA 

N2 drifted 
Positive 

+473 RPM 

-3.2% 

+1419 RPM 

-6.5% FTIT false 
occuring 0 
666 RPM N2 
Bias. 

20k/0.3 

83“PLA 

N2 drifted 
Negative 

-390 

+2.3% 

undetected 

+10.5% FTIT and N1 
false alarms 
N1 and N2 
overspeed 
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Figures 76 and 77 show time histories of pertinent engine and performance 
parameters responding to a PT4 drift with the parameter synthesis based algo- 
rithm and the advanced algorithm respectively. The thrust variations shown on 
these figures are calculated relative to the "perfect" sensor feedback case. 
As shown in Figure 77, the advanced algorithm's sensor estimates respond only 
slightly to the PT4 drift, resulting in only a minor performance degradation 
over no-failure operation. Figure 75 shows a similar failure scenario for the 
parameter synthesis based algorithm experiencing a larger performance degrada- 
tion prior to isolation, however, after isolation, the parameter synthesis 
based algorithm accommodates the failure more accurately than the advanced 
algori thm. 

Figures 78 and 79 show time histories of pertinent engine and performance 
parameters responding to an N2 drift with the parameter synthesis based algo- 
rithm and the advanced algorithm, respectively. The thrust variations shown on 
these figures are calculated relative to the "perfect" sensor feedback case. 
As shown in Figure 79, the advanced algorithm’s sensor estimates respond con- 
siderably to the N2 sensor drift, and this results in significant performance 
degradation. For this particular failure case, the parameter synthesis algo- 
rithm's detection and isolation performance was shown to be more accurate than 
the advanced DIA algorithm. The parameter synthesis algorithm detected and 
isolated the N2 drift at time of 4.4 seconds, whereas, the advanced algorithm 
detected a failure at 5.656 seconds and isolated it to fan turbine inlet 
temperature at 5.664 seconds. A second failure was detected at 7.222 seconds 
and isolated to the N1 sensor at 7.230 seconds. Therefore, the advanced 
algorithm had two false alarms and never correctly isolated the failure to the 
N2 sensor. 

This study showed that for all sensor failures, except PT6, the parameter 
synthesis algorithm detects and isolates the sensor failure for a smaller mag- 
nitude of drift than the advanced detection, isolation and accommodation 
algorithm. However, even with the larger magnitudes of drifts the effects on 
engine performance are smaller with the advanced algorithm for all sensor 
drifts with the exception of N2. Since the Kalman filter gains were sized to 
place the highest weighting on the N2 sensor input to improve filter response, 
the estimated values followed the N2 sensor drift thereby making it difficult 
to detect the failure. Therefore, the weighting on the other inputs should be 
increased to avoid the situation when a drift in one sensor can cause a signi- 
ficant decrease in engine performance and a drift in the remaining sensors has 
negligible effect. 

5.4 TRANSIENT FAILURE COMPARISONS 

Sensor failures were induced during large perturbation transients to compare 
the transient detection and isolation capability as well as observe the en- 
gine's transient behavior when operating with accommodation of failed sensors. 
All transient sensor failures were induced 1.0 second after the power lever 
snap. A summary of the results is shown in Table XXIX. 
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TRANSIENT FAILURE COMPARISON 
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Figure 76 Transient Results With the Parameter Synthesis Algorithm for a PT4 
Sensor Drift. (15PSI/sec) Sea Level Static 83“ PLA 
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Figure 78 Transient Results With the Parameter Synthesis Algorithm for a PT4 
Sensor Drift. (-400 RPM/sec) 20k/0.3Mn, 83“ PLA 
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Figure 79 Transient Results With the Parameter Synthesis Algorithm for a PT4 
Sensor Drift. (-400 RPM/sec) 20k/0.3Mn, 83“ PLA 
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Table XXIX shows consistantly good transient detection and isolation with the 
parameter synthesis based algorithm. During the transient, fan turbine inlet 
temperature overshoots were observed. These overshoots result from operating 
on an uncompensated signal and are on the same order of magnitude as the 
no-failure case. At 0 ft/1.2Mn, when fan turbine inlet temperature is failed, 
a steady state over- temperature is observed. This results from synthesizing 
the signal to be lower than the reference. 

The advanced detection, isolation and accommodation algorithm, as shown on 
this Table, has problems with false alarms. The fan turbine inlet temperature 
estimator consistently caused false alarms for most of the sensors failure 
cases examined. Therefore, additional refinements of the model and algorithm 
are required to correct this problem. 

Generally, transients run with the advanced algorithm were slower. This 
results from the fan turbine inlet temperature estimator reducing fuel flow 
during the transient. The FTIT input signal used with the parameter synthesis 
algorithm is an uncompensated signal which allows fuel flow to accelerate 
faster, however, does result in more severe FTIT transient overshoots. A typi- 
cal comparison of the two algorithms' transient behavior is shown on Figure 
80. This figure shows good transient response when accommodating the PT4 fail- 
ure with both algorithms despite the N1 false alarm which occurred with the 
advanced algorithm. Additional plots of pertinent engine and performance 
parameters for selected transient operation failure scenarios are included in 
Appendix E. 

5.5 MULTIPLE SENSOR FAILURES 

Multiple sensor failures were simulated at sea level static to compare the two 
algorithms capability to detect, isolate, and accommodate a second sensor 
failure. For the failure scenarios examined, the advanced detection, isolation 
and accommodation algorithm showed less performance degradation than the para- 
meter synthesis algorithm. Figure 81 compares the thrust variations relative 
to perfect sensor feedback case for the parameter synthesis based algorithm 
and the advanced algorithm for a PT4/N2 multiple failure at sea level static, 
83" PLA. As shown in this figure, the advanced algorithm suffers very little 
additional performance degradation with the second failure (57 pound thrust 
variation) whereas the parameter synthesis based algorithm shows a much larger 
performance degradation (2100 pounds thrust variation). Similar results were 
observed for the other multiple failure scenarios. 

5.6 ACTUATOR FAILURES 

The engine nozzle area actuator was slewed wide open at sea level static, 83" 
PLA, to simulate a hardover actuator failure. This test was conducted to 
verify that the two detection, isolation and accommodation algorithms would 
not confuse the actuator failure with a sensor failure. This test showed that 
neither the parameter synthesis algorithm nor the advanced algorithm falsely 
detected a sensor failure when the actuator failure was induced. 
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Parameter synthesis 


Advanced concept 



NOTE PT4 FAILED 50 PSI AT TIME = 4.0 SECONDS 


Figure 80 Failure Transient Comparisons for an PT4 Sensor Failure at Sea 
Level Static Conditions and 83* PLA 
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Figure 81 Thrust Transients Resulting From a Multiple Failure of the PT4 and 
N2 Sensors 
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SECTION 6.0 


RESULTS AND CONCLUSIONS 

The following results and conclusions result from this study: 

1. Failure Mode and Effects Criticality Analysis Results: 

a. An analysis of failure characteristics for the state-of-the-art sen- 
sors selected for the FI 00 multivariable control mode showed that the 
majority of the sensor failures recorded were out-of-range failures 
(90 percent for speed sensors and pressure sensors and 75 percent for 
temperature sensors). Since 90 % failure coverage is not satisfactory 
for most control applications, there is a need for detection, isola- 
tion, and accommodation algorithms to provide in-range failure 
coverage. 

b. All out-of-range sensor failures exhibit critical failure character- 
istics with the FIDO multivariable control mode. Critical is defined 
as failures that result in a fan or compressor surge, excessive 
thrust variation (greater than 10%), or a rotor overspeed above the 
operating limits. 

c. In-range failures (drifts) of the N2, TT2, TT25, FTIT, PT2, PT6, and 
PT4 sensors are also shown to exhibit critical failure characteris- 
tics and therefore, require either sensor redundancy or analytical 
redundancy to ensure continued operation in the event of a sensor 
failure. 

2. Simplified nonlinear engine models were developed for use in advanced 
algorithms for sensor failure detection, isolation, and accommodation. The 
models worked well except at high altitude (greater than 45K ft) or high 
Mach number conditions (greater than 1.2). The problems that arose at 
these conditions were found to result from an insufficient number of 
linear models available to constrain the curve fitting procedure for the 
matrix elements at these flight conditions. Therefore, it is concluded 
that generating more linear models and improving the curve fits will 
significantly improve the accuracy of the algorithm at the high altitude 
and high Mach number conditions. 

3. Numerous advanced concepts for detecting, isolating and accommodating 
sensor failures can be developed based upon such techniques as Kalman 
filters. A screening process led to the selection in this program of an 
advanced concept which uses a Kalman filter to generate residuals, a 
weighted Sum Squared residual technique to detect soft failures. Like- 
lihood Ratio testing of a bank of Kalman filters (each designed with one 
input missing) for isolation, and reconfiguring of the normal mode Kalman 
filter by eliminating the failed input to accommodate the failure. This 
was shown to be a feasible detection, isolation, and accommodation 
algorithm. 
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4. During the final screening process; the advanced DIA Concept 2, described 

in conclusion 3, was selected to be the most viable concept for detailed 

evaluation and comparison against the baseline parameter synthesis tech- 
nique. The rationale for selecting Concept 2 are as follows: 

1. Since concept 2 uses maximum information (all other sensors) to 
generate estimates of each parameter it is least sensitive to model 
errors. 

2. The fault information is in the innovations. This allows concept 2 to 
respond quickly to sensor failures. 

3. Concept 2 provides good signal conditioning when no sensor failures 

are present. 

5. The parameter synthesis concept developed under this program provided a 

viable baseline for comparison against the advanced concept. This compari- 
son showed that the advanced concept was also a viable technique for 
detecting, isolating and accommodating sensor failures. 

6. Parameter Synthesis/ Advanced DIA Concept Comparisons: 

a. The advanced concept feeds back the estimator values to the control 
laws which result in a steady state hangoff (estimation error) with no 
induced sensor failures. This estimation error varies as a function of 
of flight condition due to the modelling errors previously noted in 
conclusion 2. 

b. Steady state comparisons between the parameter synthesis and the 
advanced concepts showed both to have very good detection, isolation, 
and accommodation for PT6, PT4, N1 , and N2 sensor failures at most 
operating points. 

c. Neither the parameter synthesis nor the advanced concept provides ade 
quate FTIT protection when operating on the synthesized or estimated 
value. These results are consistent with previous in-house studies 
which showed the accuracy of a synthesized signal provides inadequate 
temperature limiting protection. With the advanced concept, however, 
improving the accuracy of the modeling approach within the algorithm 
may significantly improve the accuracy of the FTIT estimates. 

d. For most conditions evaluated, there was less failure/accommodation 
transient with the advanced concept than with the parameter synthesis 
concept. 
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f. With the exception of PT6, the parameter synthesis algorithm detects 
and isolates the sensor failure for a smaller magnitude of drift than 
the advanced detection, isolation and accommodation algorithm. How- 
ever, even with the larger magnitudes of drifts the effects on engine 
performance are smaller with the advanced algorithm for all sensor 

drifts with the exception of N2. Since the Kalman filter gains were 

designed to place the highest weighting on the N2 sensor input, the 

estimated values tracked the drifted input signal which made the 
advanced concept unable to detect and isolate the sensor failure. 
Refinements to the algorithm are required to redistribute the weight- 
ing of the Kalman filter gains among the other inputs to avoid the 
situation when a drift in one sensor can cause a significant decrease 
in engine performance and a drift in the remaining sensors has 
negligible effect. 

h. The advanced concept showed less performance degradation than the 
parameter synthesis concept for the multiple sensor failure scenarios 
examined. 

7. The implementation of failure logic in a control system can have signifi- 
cant impact on computational requirements and, hence, the design of the 

digital control. Therefore, the control designer should evaluate the 
failure rates and failure modes of each sensor and apply sophisticated 
concepts only where warranted to insure the result is the simplest and 
most cost-effective control system which provides desired operational 
benefits and mission reliability. 
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Section 7.0 


RECOMMENDATIONS 

1. Refine the simplified simulation within the advanced DIA concept to im- 
prove the performance of the concept. Refinement to the simplified simula- 
tion should include: 1) improving the steady state accuracy by increasing 
the number of linear models used to constrain the curve fitting procedure 
for the matrix elements over the desired flight envelope, and 2) improving 
the dynamic portion of the simplified simulation to be comparable with the 
nonlinear simulation. 

2. Develop refinements to the advanced DIA algorithm to: 1) insure that the 
logic is compatable with the revised simplified engine simulation, and 2) 
minimize the steady state estimator hangoff errors. 

3. Develop algorithm simplifications to the DIA algorithm to reduce the 
complexity of a microprocessor based real-time control implementation of 
the DIA algorithm. 

4. Implement the revised algorithm on a microprocessor for detailed evalu- 
ation utilizing a real-time engine model and eventual engine test. 
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APPENDIX A 


FAILURE MODE AND EFFECTS ANALYSIS 

The following paragraph summarizes the predominant causes of in-range sensor 
failures. 

Speed Sensor Failure 

In-range failures of the N1 system may be caused by the following: 

0 Failure of the Divide by 2 circuit causing a degredation in high speed 
range. 

0 Open circuit on an N1 connector pin resulting in loss of up to 1/2 word 

0 Failure in mux switch resulting in using high speed counter in low speed 

range. 

N1 Accuracy = +^3 rpm 

N1 Operating Limits = 4500 - 10200 rpm 

N1 Range Limits = 1300 - 13000 rpm 

In-range failures of the N2 system may be caused by the following: 

0 Failure of the lamination stack or winding 

0 Failure in the Divide by a circuitry resulting in a division by 4 or 2 

0 N2 Period Counter and Control failures causes loss of 1/2 word, or random 

bit pattern, or counts for the wrong number of periods. 

N2 Accuracy =? +3 rpm 

N2 Operating Limits = ?000 to 13000 rpm 

N2 Range Limits = 1300 to 15000 rpm 

Temperature Sensor System Failures 

In-range failures of the TT2, TT2.5, and FTIT systems may be caused by the 
fol 1 owi ng : 

0 Open circuit in one or more of the probes, junctions of a probe or 
temperature measurement circuits of the control. 

0 Short circuit or ground in the TT2 or TT2.5 or FTIT probe or temperature 
measurement circuits of the control 
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0 Failure of a particular gain amplifier 


TT2 Accuracy 
TT2 Operating Limits 
TT2 Range Limits 
TT2.5 Accuracy 
TT2.5 Operating Limits 
TT2.5 Range Limits 
FTIT Accuracy 
FTIT Operating Limits 
FTIT Range Limits 


= +7“F 

= -50 to +200“F 
= -no to +440’F 
= +7“F 

= -50 to +695 “F 
= -no to 840“F 


= +12“F 


- ^ITfjage ^^^^ba 
= -65“F to FTITbase 


se +1030"F 
+1999”F 


Pressure Sensor Failures 


In-range failures of the pressure sense systems PT2, PT4, and PT6 may be 
attributed to the following types of failures: 

0 Failure of the probe or pressure tubing 

0 In-range frequency shifts of the vibrating cylinder 

0 Loss of 1/2 word or random bit pattern from the Period Counter/Control 


0 Power strobe of only one PROM causing no effect on the signal which is 
properly strobed. The other signals are wrong, and possible in range. 

0 Power strobe two PROM's with results similar to above except that the 


unstrobed signal is wrong, possil 

PT2 Accuracy 

PT2 Operating Limits 

PT4 Accuracy 

PT4 Operating Limits 

PT4 Range Limits 

PT6 Accuracy 

PT6 Operating Limits 

PT6 Range Limits 

Tabulation of the results of failing 
out-of-range limits are shown on the 
pages 150 and 151 . 


in range. 

= +.03 psi 
= 1 to 30 psi a 
= +.4 psi 
= 40 to 500 psi a 
= 1 to 599 psi a 
= +.07 psi 
= F to 60 psi a 
= 1 to 109.8 psi a 

each sensor to their upper and lower 
following tables and are summarized on 
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FAILURE TYPE OUT-OF-RANGE FLIGHT CONDITION 20K/0 . 3 


P4 W 




ro 

00 


CN 

:2 

14348 

12408 

10770 

12885 

12559 

16946 

10806 

12420 

9242 

12681 

11437 

11597 

11079 

12210 

12416 

12394 


^ o 

O fH 

rH CN 

in m 

G\ CN 

CO KD 

o 

in VD 

LO 

rH 

m 

CVi C^ 

a\ O 


<N m 

KO 00 

»x> 

CO CO 


z 

<o 

^ r- 

rH m 

00 r- 

CO CO 

m LO 

r*' 




cr» c\ 

r*** rH 

o a\ 

r- <Ti 

in o 

o^ 00 

00 

o^ 




iH 



rH 










VD 









VO 

vn 









• 

9 



• 


ea 

(N 

ro 

00 ^ 

m r- 

O ^ 

o VO 

CN 

C" VD 

CN 

04 

00 00 

o r- 

r~' r- 

O 00 

in 00 

^ in 

CN 

VD 00 

CO 


rH f— 1 

rH rH 

iH rH 

rH rH 

rH 

rH rH 

rH 

rH rH 

rH 

* 

CO CO 


CN 

CO r— 

1— 

r— VO 

ir> 

r- «5i- 

o 


<y> f— 



+ 

00 CO 

O 1— 

CSJ 

CO I— 


M 

+ + 


+ e— 


csj 

CN CO 

CO 

1 -h 




< 

+ 

1 

1 + 

1 1 

* 



<3 













in 

















u 

IT) (7> 

ro m 

0\ I-H 

m 

rH O 

VD in 


00 rH 

r-* 


00 

ro 

<7i 

00 in 

OV CTi 

CO CN 

KO 

in VD 

m 

& 

CJ cH 

• • 

rH rH 

• • 

rH CO 

« • 

rH rH 

• • 

rH rH 

9 9 

O rH 

9 9 

rH 

9 

rH rH 

9 9 

rH 

9 






00 






r- 00 

r' 

lO CO 

00 

00 CO 

a VO 

N* 


ro 


in in 

CT> CO 

rH 00 

00 in 

<T> CO 

oc 

00 

^ m 



rH i-H 

• • 

O CN 

• • 

(N I-H 

• • 

rH rH 

• 9 

O CN 

9 9 

9 • 

CN 

9 

CN rH 

9 9 

■I 

Hi 

lo 

Hi 

Lo 

Hi 

Lo 

Hi 

Lo 

Hi 

Lo 

Hi 

Lo 

Hi 

Lo 

Hi 

Lo 



<0 

c 

E 

o 


o 

s- 





in 



Eh 





n 


CN 



M 


CN 

CN 

VD 

E 

§ 


IN 

N2 


PB 


s 

e 

C 

2 


132 




ft 

00 


00 



8 


o 

M 

iJ 

ft 


W 


N2 

14325 

12387 

12412 

12515 

12434 

15724 

12602 

13177 

13039 

10765 

12739 

11701 

CM 

CM 

rH ro 
ro rH 
rH iH 

13112 

13102 

13207 


iH VD 

1 

^ <J\ 

CO 


0 ^ 

CN ro 

ro 

■H 0 

ro 


<n cr» 

^ 0 

rH 0 

■ra* 

rH 

CM rH 

ro 

CN CN 

VD 

2 

<N 00 

VO 0 

0 OV 

VO 

CN C\ 

00 

0 ro 

ro CD 



0 a\ 

00 0 

0 <y\ 

a^ 0 

0 in 

<y\ r- 

0 

0 ov 

0 


iH 


r—i 

rH 

rH 


rH 

rH 

rH 

ca 

0 <T> 

t-' 0 

r-{ to 

VO ^ 3 * 

in ov 

■ra* CD 

00 VO 

0 'i* 

ro 

04 

m 00 

ro 0 

0 OV 

VO 

(N CO 

CD CTv 

CM 0 

ro CM 



>!r n 

n «!r 

CO 

ro 'ey 

■r^* rH 

ro CM 

eg 

t3< <?ih 


» 

KO VO 

CO 10 

VO r>- 

0 r- 

tr> r— 

CD 

CD r- 


0 

E-* 


VO CO 

r— CO 

CO to 

1 — eg 

in ro 

ro CM 

r— CM 


M 

+ + 

fl- + 

+ + 

•— + 

1 

+ 

1 

1 C\J 

+ to 
1 



04 

<3 

















1 



8 

ro 

fo 

CO 

CO 

VD in 

^ CD 

hH 

CO 00 

rH 


0 rn 

^ iH 

CO VD 

n in 

T3* 0 

^ CO 

■ulS 

m 'S' 

00 


m 0 

rH 0 

0 ^ 

r-l rH 

rH rj 

rH rH 


rH rH 

rH 

v/j 

• « 

1 

• • 

,* • 

• • 

• • 

• « 

■ 

• • 

• 

FAN 


r~ o> 


in 

00 

■ 

rH ^ 

CO 

00 


VD ^ 

VO CO 

CO ^ 

in 

in 

in nn 

ro CM 

VD CM 

00 


<N <N 

rH CM 

CM CM 

CN CN 

CM rH 

CM iH 


CM CM 

CN 


• • 

• • 

• • 

• t 

• • 

■■ 

H 

• • 



i3 '£ »3 




d Q d 9 d 9 d 9 d 9 

Sm ffihH 2 Cm 2Cm 



CQ 

04 


CN 


VO 


l: & & 


(0 

c 


2 


133 


*From Nominal 







FAILURE TYPE OUT-OF-RANGE FLIGHT CONDITION 34K/1.9 83 
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FAILURE TYPE CXJT-OF-RANGE FLIGHT CONDITION 50K/0.9 83 
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FAILURE TYPE OUT-OF-RANGE ■ FLIGHT CONDITIO! 65K/2.5 
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APPENDIX B 


DIA SCORING SYSTEM 


Mathematical equations which were derived to quantitatively score each 
candidate DIA algorithm for both detection and accommodation criteria are 
described in the following appendix. 

ENGINE PROTECTION 


Critical Design Limit 


Control Limit 
Threshold 


General Ground Rule: 



Decrease score for how much a limited parameter 
exceeds a limit due to sensor failures interacting 
with the control mode during transients and steady 
state operation. 


General Scoring Formula: 


If Y (t) > Y ; 
DIA TH 


SCY (t) = [AMAXl (0.0, SGN * [Y (t) - Y (t)])] * WTFC 

DIA NML 

Where: WTFC = Weighting Factor = 


SGN *[ WT2 ] * [[AMAXl (0.0, SGN*[Y (t) - Y ])] * 

m DIA CL 

CR NML 


SGN* [ WT2 ] + 1.0] 

Y -Y 
CR CL 


SCY(t) = Time Varying Scoring 
SGN = Sign (either +1 or -1 ) 
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YDlA(t)= Parameter Response With Dia Concept 

YNML(t)= Nominal Parameter Response 

WTl = Weighting Constant 

WT2 = Weighting Constant 

Ycr = Critical Operating Limit 

Ycl = Control Limit 

Y = Threshold, Above Which, Scoring Formula Is Executed 
TH 

This equation will penalize a DIA concept if the engine protection parameter 
exceeds its respective nominal characteristics for operation above a threshold 
value. The scoring weighting factor (WTFC) is a function of the proximity of 
the nominal characteristics [YNML^t)] relative to the critical design limit 
(Ycr). 


This weighting factor is increased if the DIA concept exceeds the control 
limits. The weighting constants (WTl and WT2) require different constant for 
steady state than transient operation. Since it is more critical to exceed 
the control limits in steady state than transiently, WT2 is weighed more 
heavily than WTl in steady state. For transient operation, excursions above 
nominal operation is of more concern; therefore, WTl is weighed more heavily. 


Total Score (for each parameter) 


TSCORE 



SCY(t) 


/N 


Where N = Number of points run. 

N is only increased by 1 for "quasi" steady state operation. -It is therefore 
necessary to be aware if the system is in steady state for both the total 
score, and to determine the correct weighting factors. This may be done by 
either programming, as a function of time, a schedule indicating when steady 
state operation is expected (from the power lever profile), or, using simple 
logic, as shown on Figure 1. This figure shows simple logic which could be 
implemented; however, programming a steady state flag may be more desirable, 
since this type of logic could give erroneous results if the DIA concept was 
unresponsive to an input; i.e., transient should be occuring, yet the DIA 
algorithm results in steady state operation. 

Constants (for engine protection parameters) 

Note: Weighting factors designed to give a score of 5 at ^cr 
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Temperature limits (FTIT) 


Steady State 


WT1 

WT2 


1.125 

3.5 


Transiently 

4.5 

0.125 


YcR = Yth + 129“C. Ycl = Yjh + 25“C. Yjh = FTITbase +563“C 
SGN = +1 


Speed Limits 
N2 


Steady State 

WTl 1.125 

WT2 3.5 


Ycr = 13720. Ycl = f(T2). Yjh = Yql - 100 RPM 
SPN = +1 
N1 


Steady State 

WTl 
WT2 


1.125 

3.5 


SGN = +1 

Ycr = 12000, Ycl = n 5 oo, Yjh = 11000 

Pressure Limits (Pb) 


Steady State 

WTl 
WT2 


1.125 

3.5 


Ycr = tbd, Ycl “ 580, Yjh = S50 

SGN = +1 


Transiently 

4.5 

0.125 


Transiently 

4.5 

0.125 


Transiently 

4.5 

0.125 
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Engine Stability 

Fan and Compressor Stall Margins 


The ground rule for fan and compressor stability is to not allow fan stall 
margin to go below 0.15 or compressor stall margin to go below 0.05. Stall 
margin is defined by: 


SM = 


(Pressure Ratio Stall - Pressure Ratio Operating) 
Pressure Ratio Stall . 


At constant airflow 


The same equation set is used as was used for engine protection. Note: The 
value of "SON" is -1.0 to reflect that a higher surge margin is more desirable. 


Note: Weighting factor designed to give a score of 7.5 at SM = 0. 


Fan 


WTl 

WT2 

YcR = 0. Ycl = 15. Yth = 18 
SGN = -1 
Compressor 

WTl 

WT2 

Ycr = 0. Ycl = 5. Yjh = a 
SGN = -1.0 

Steady State Performance and Accuracy 


Steady State 

1.25 

5 


Steady State 

1.25 

5 


Transiently 

1.25 

5 


Transiently 

1.25 

5 


Variation from nominal thrust will be scored for steady state operation at 
fixed PLA. 


SCY (t) = 


•"nnml" '"ndia 


MLSS 


10% variation in thrust from nominal will score 15 pts. 


MLSS = 


Steady State 
150 


Transiently 

0 
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Transient Requirements 

0 Based on time to 90% thrust change (assumes only perform tests for parts 
of the PLA profile where 90% thrust change occurs) 

0 10% overshoot over references (Nl, EPR) considered critical (only 

performed during parts of the PLA transient where referenced value is 
exceeded) 


SCY (t) [AMAX1 (0.0, [TRdia - TR^ml] )] * MLTR 

+ [AMAXl (0.0, [OSdiaN " OSnmLN] ) / (0-1 * NIREF)] 

* MLNOS + [AMAXl (0.0, [ OSqiaE - OSnmLE] ) / (0.1 * EPRREF)] 

* MLEOS 

Where: 


\ 


TRqia = Time to 90% Thrust Change for DIA Concept 

TRnml = Time to 90% Thrust Change for Nominal Response 

OSdian = Nl Overshoot, DIA Concept 

OSdiae = EPR Overshoot, DIA Concept 

OSnmln Nominal Nl Overshoot 

OSnmLE = Nominal EPR Overshoot 


MLTR 

Steady State 
0 

Transiently 

5 

MLNOS 

0 

5 

MLEOS 

0 

5 


For total score for steady state accuracy and transient response, use same 
TSCORE equation used in engine protection and engine stability. 

DIA Detection Performance (50 PTS) 


Hit/Miss Ratio 


50% will score 20 PTS 


DSCORE = NIF - NOH * 

fnr~ 
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Where: 

NIF = Number of induced failures 
NOH = Number of Hits 

Time to Detect (15 PTS Score) 

Rational: The advanced electronic control design for the FlOO engine takes 

108 ms to detect a failure; therefore, the concept is penalized 
for times greater than this. A 300 ms detect time results in the 
worst score. 

The concept is penalized for excessive thrust change between when 
the falure was induced to when the failure was detected for steady 
state operation. A 10% thrust variation results in worst score. 

Scoring Equation: 

DSCORE = [AMAXl [0.. (TFD - TFI - 108)]) / 192] * WTTD 

+ FNTI - FNTD * WTF 

FETI 


Where: 

TFD = Time Failure Detected 

TFI = Time Failure Induced 

FMTI = Thrust When Failure Induced 

FNTD = Thrust When Falure Detected 

Steady State 


WITD 5 

WTF 1 00 

Number of False Alarms — 


Transiently 

15 

0 


Ground Rule: 

for every 10 hits, one false alarm is tolerable, three false 
alarms scores 15 PTS 

Scoring: NOFA * 50 = DSCORE 

NOH 

Where: 

NOFA = Number of False Alarms 

NOH = Number of Hits 
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APPENDIX C 


LINEAR MODEL DEVELOPMENT 


A representative model should describe engine behavior over the entire flight 
envelope. The flight envelope was parametrically investigated (Reference 1) to 
identify portions where limiting boundaries were approached. The envelope was 
then partitioned into linearization regions, wherein each region shares bound- 
aries with other regions and the envelope boundary. These linearization re- 
gions encompassed a region where operating characteristics were critical to 
some limiting variable. Model generation points were chosen to span the 
envelope and center on the linearization regions. A set of linear equations 
models the important dynamics in a linearization region and about an equili- 
brium point. For the locally linear models to operate throughout the flight 
envelope adaptability to ambient parameters is required. 

The thermodynamic equations which describe turbine engines are nonlinear, and 
in general may be written as 


X = f [x(t) , u(t) , 8(t)] 


where x(t) represents the dynamic variables, u(t) represents the controls, and 
(t) represents ambient parameters. Relationships of non-dynamic variables can 
be represented as nonlinear, static equations as follows; 


y(t) = h [x(t) , u(t) , e(t)] 


( 2 ) 


The nonlinear equations (1) and (2) describe state and ouput time histories, 
x(t), y(t) for given control and ambient inputs, u(t), o(t); where t tp, 
and initial state, Xg = x(to). Simultaneously solving equations (1) and 
(2) typically require high computational capability. In addition, even large- 
scale digital or hybrid simulations do not produce observed behaviour exactly. 
A simplified model reduces the computational burden considerably while still 
representing acceptable engine behaviours. A detailed description of model 
development is given in reference (1). Utilizing the perturbational quantities 
to equations (1) and (2) the following linear equations result: 


6x = F(t) 


6x + G(t) 6u + 


(3) 


6y = H(t) 


6x + D(t) 6u + 


0 ( 6 ^) 


(4) 
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where 


F(t) 


6f [x(t)» Up(t), e(t)] 
6x 


X = XQ(t) 


G(t) = 


<5f [x(t), UgCt), e(t)] 

6U 


U = U^(t) 


( 5 ) 


The term 6x is an n x 1 vector of states, 6u is an m x 1 vector of controls, 
and 6y is a p x 1 output vector. The F, 6, H, and D terms in 5y representing 
the compatibly dimensioned state dynamics matrix, control distribution matrix, 
and output distribution matrices, respectively. Ignoring second order pertur- 
bational quantities and assuming that the dynamics matrices are constant 
within a region of state space, then equations (3) and (4) reduce to linear 
constant coefficient, differential equations: 

( 6 ) 

6x = F 6x + G 6U ^ ' 


6y = H 6x + D 6u ( 7 ) 

The linear models are valid in the neighborhood of an equilibrium point (xq, 

Uq, 00^ 3nd describe perturbational motion 6x, 5y away from equilibrium. 
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APPENDIX D 


MODAL DECOMPOSITION 


Simplified, low order, linear models are derived from the high order linear 
models using a modal reduction procedure discussed in reference (1). High- 
lights of the procedure are discussed below. 

The linear equations (6) and (7) (Appendix C) can be transferred to block 
diagonal form assuming the n x n dynamics matrix, F, has no repeated eigen 
val ues: 


6x = Tz 


( 8 ) 


which gives 


2 = AZ + E6u 


(9) 


6y = HTz + D6u 


( 10 ) 


Where A is an n x n block diagonal matrix, T is an n x n matrix composed of 
the column eigenvectors F; z is an n x 1 modal coordinate vector; and l is the 
n X 1 modal control distribution matrix. The system of equations (8) through 
(10) can be partitioned into a set of q states and of q eigenvalues and n - q 
states and eigenvalues as follows: 



:Ti2] 

i-* • 1 



(11) 

: T22J 

L ^2 



1 1 

1 1 

n! n 
rv5 ,t-* 

1 1 


j 6U 

(12) 


Where 5 X] , and zi , are q x 1 vectors partitioning the state and modes and 
a X 2 and Z£ are (n-q) x 1 vectors partitioning the remaining states and 
modes. 

If within the time frame of interest, the following relatonship is true: 

(13) 
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then the following reduction can be made 


6x^ = 6x^ + 6u 


(14) 


where xi,is now the q x 1 state vector, F is the q x q dynamics matrix, and 
G is the q X m control distribution matrix. Also: 


6y = [Hj 




+ D6U 


(15) 



(16) 


where X 2 is treated as an additional (n-q) x 1 output vector with a (n-q) x 
q state distribution matrix H* and a (n-q) x m control distribution matrix 
D*. The original output distribution matrices, H and D, are modified to H 
and D respectively. The equations for these matrices in terms of model 

decomposition are: 


= ''l ^11 

(Ai T„-l Aj-l E2 + E;) 


H* = Tjj-1 


" ^^21 ^11 ' ^12 ■ ^ 22 * '' 2 ' h 

= Hj + H* 


= D + H 2 D 


(17) 

(18) 

(19) 

( 20 ) 
(21 ) 
( 22 ) 


Thus by assuming (n-q) modes are equilibrated, the nth order system (6) is 
reduced to the qth order system (14) with q state and B+n-q outputs. 

A block diagram of the model reduction process is shown in Figure D-1 
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Figure D-1 Generation of Design Models 
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APPENDIX E 


TYPICAL TRANSIENT OPERATION COMPARISONS 

The following figures present additional transient failure operation scenarios 
comparisons between the selected advanced concept and the baseline parameter 
synthesis concept. 
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THRUST CHANGE % SMHC SMAF A TT45 


Parameter synthesis 


Advanced DIA algorithm 


(D 

CL 




UJ 

0 
Z 
< 

1 

u 

(/> 

D 

GC 

X 




NOTE PT6 FAILED 30 PSI AT TIME = 4 SEC 


Figure E-1 Failure Transient Comparisons at Sea Level Static Conditions and 
20® to 83® PLA Snap PT6 Sensor Failed 
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THRUST CHANGE % SMHC SMAF A TT45 


Fi gure 


Parameter synthesis 


Advanced DIA algorithm 


12.800 

12.400 
12,000 
11,600 

g 11,200|- 
10,800 

10.400 - 

10,000 

9,600 - 
9,200 - 
500p 
400 - 
3X - 
200 - 
100 - 
oL- 

0 200|- 
0180 - 
0160 - 
0140 - 

012oL 

0440p 
0400 - 
0 360 - 
0320 - 
0280 - 
0240 - 
0200 - 
oieoL 







!S 

< 


1 4.000 p 

13.000 - 

12.000 - 
11,000 - 
10,000 - 

9,000 - 
lOOOp 

800- 

600- 

400- 

200 - 

0 - 

- 200 - 

0320r 

0280 - 

< 0240 - 

C/5 0200- 

0160- 

012oL 

0,260 r 

0,240 “ 
0220 - 

a 

X 
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0140 - 
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LU 

0 
z 
< 

1 
CJ 
H- 
(0 
D 
OC 
I 


*NOTE: N2 FAILED 2000 RPM AT TIME = 40 SECONDS 



SNCSCH 


N2 estimate 

N2 ACTUAL 






TIME 


-2 Failure Transient Comparisons at 20,000 ft/0.3 Mn Conditions and 
83" to 24" PLA Snap Decel . at Time = 3.0 Seconds N2 Sensor Failed 
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THRUST CHANGE % SMHC SMAF A TT45 


Parameter synthesis 


Advanced DIA algorithm 
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NOTE: N2 FAILED 2000 RPM AT TIME = 4.0 SECONDS 

Figure E-3 Failure Transient Comparisons at 
40" to 83" PLA Snap at Time = 3.0 
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45,000 ft/0.90 Mn Conditions and 
Seconds N2 Sensor Failed 
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LIST OF SYMBOLS 


DIA 

Di 

F 

FMECA 

FTIT 

G 

Gi (k. e ) 
GLR 
HO 
HD 

t(.) 

All 

Z 

* 

z 

p(7(.)/Hi) 
P (0, 1) 

X 

X 

6 

e 

^ss 

Hi 

Hill- 


Detection, Isolation and Accommodation 

Control to output distribution matrix corresponding to ith failure 
System Dynamics Matrix 

Failure Mode and Effects Criticality Analysis 
Fan Turbine Inlet Temperature (“R) 

Control to state distribution matrix 

Effect of a failure of type; at time d on residual at time k 

Generalized Likelihood Ratio 

Filter designed on the assumption of no failure 

Filter designed on the assumption of failure present 

Innovations process 

Threshold for isolation corresponding to ith channel 
Measurement output vector 
Estimated output vector 

Probability density function corresponding to T(.) assumming 
hypothesis Hj is true 

Normal density with zero mean and unit variance 

Threshold for failure detection 

State vector 

Estimated state vector 

Failure parameter or failure state 

Estimated value of failure parameter 

Steady state value of state vector 

Hypothesis corresponding to ith failure 

Bank of filters used in Concept 1 isolation technique; designed 
on the assumption (hypothesis) of a bias present in ith measure- 
ment 
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H2Ii 

Bank of filters used in Concept 2 isolation technique; designed 
on the assumption (hypothesis) that ith measurement is faulty 
and is ignored as the input to the filter 

LR 

Likelihood Ratio 

7i(.) 

Innovations produced by filter corresponding to i^^i failure 

y 

Mean value of innovations 

a 

Standard deviation 

Mn 

Mach number 

MVC 

Multivariable Control 

N1 

Fan Speed (rpm) 

N1C2 

Corrected low rotor speed 

N2 

Compressor Speed (rpm) 

N2C2 

Corrected high rotor speed 

PLA 

Power Lever Angle (degrees) 

PT2 

Engine Face Pressure (psia) 

PT4 

Burner Pressure (psia) 

PT6 

Augmentor Total Pressure (psia) 

q 

Dynamic pressure 

TT2 

Engine Face Temperature (’’R) 

TT25 

Fan Discharge Temperature ("R) 

T3 

Compressor discharge temperature 

T4 

Burner exit temperature 

U 

Control or input vector 

Xb. %> Zb 

Base points vectors of state, control and measurement 
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